You must configure which firewall feature to enable a data-plane interface to submit DNS queries on behalf of the control plane?