topic DNS Fall Back is not working in GP 5.2.x Series in GlobalProtect Discussions

DNS Fall Back is not working in GP 5.2.x Series

SubaMuthuram — Tue, 12 Oct 2021 04:21:57 GMT

Hi,

I am using GP-5.2.6 with split tunnel, When ever the tunnel configured DNS not resolving a hostname, The traffic is not falling back to local DNS server configured in physical adaptor. Actually this is not working in all 5.2.x series.

But the same scenario working in GP-5.1.8(5.1.x). Palo Alto has introduce split-DNS feature from 5.2 series, Is it anything related with this issue.

Re: DNS Fall Back is not working in GP 5.2.x Series

nikoolayy1 — Sun, 17 Oct 2021 12:28:14 GMT

You can test it on test users as it could be related for domains that are added to not enter the split tunnel:

https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/globalprotect-portals/define-the-globalprotect-client-authentication-configurations/define-the-globalprotect-app-configurations.html

https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-new-features/new-features-released-in-gp-app/split-dns

Also see this option "Resolve All FQDNs Using DNS Servers Assigned by the Tunnel (Windows Only)" as it can also be related to your issue to test changing it for couple of test users that you made specific portal app config to be assigned based on AD user/group:

https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-portals/define-the-globalprotect-client-authentication-configurations/customize-the-globalprotect-app.html

if needed upgrade to the latest globalprotect version.

Re: DNS Fall Back is not working in GP 5.2.x Series

SubaMuthuram — Mon, 18 Oct 2021 01:41:44 GMT

Hi Nikolay,

I already Did, "Resolve All FQDNs Using DNS Servers Assigned by the Tunnel (Windows Only)" without this option in GP 5.1.x the DNS fall back to local DNS, But in 5.2.x it is not. But I enable "Resolve All FQDNs Using DNS Servers Assigned by the Tunnel (Windows Only)". It is working fine.