topic Re: DNS based traffic shows incomplete when connected to GlobalProtect in GlobalProtect Discussions

DNS based traffic shows incomplete when connected to GlobalProtect

Salathiwe — Sat, 04 Nov 2023 07:44:55 GMT

Hi all

I have an issue noticed that DNS-based traffic shows incomplete when users are connected to GlobalProtect.
The same traffic is fine when we disconnect from GlobalProtect

Re: DNS based traffic shows incomplete when connected to GlobalProtect

Raido_Rattameister — Sun, 05 Nov 2023 06:11:43 GMT

DNS server is public?

GlobalProtect is in separate zone?

GlobalProtect zone is in SNAT outgoing policy?

Re: DNS based traffic shows incomplete when connected to GlobalProtect

Salathiwe — Mon, 13 Nov 2023 13:28:01 GMT

-Is the DNS server public? no

-Is GP in a separate zone and NAT outgoing policy?yes

Re: DNS based traffic shows incomplete when connected to GlobalProtect

Salathiwe — Tue, 14 Nov 2023 08:32:42 GMT

Hey anyone with a fix for this?

Re: DNS based traffic shows incomplete when connected to GlobalProtect

aleksandar.astardzhiev — Tue, 14 Nov 2023 13:33:38 GMT

Hi @Salathiwe ,

Just to clarify does your DNS actually work so user connected to GlobalProtect are able to resolve domains? Or you just noticed some DNS traffic that is incomplete, but there is no actual issues with name resolution?

If the traffic is sent to internal DNS server (that is behind your firewall) and it is incomplete, it looks like you need to troubleshoot the path from your firewall (more specifically GP IP pool range) to the internal DNS server.

And what do you mean by "same traffic is fine when GP is disconnected? Are you using GP tunnel mode when user is inside your LAN so it can still reach internal DNS?