topic Re: Palo Alto unable to resolve its own static entries in Next-Generation Firewall Discussions

Palo Alto unable to resolve its own static entries

ciscojuniperf5 — Mon, 03 Feb 2025 21:14:44 GMT

Palo Alto unable to resolve its own static entries

When I try ping host abc.com

it says ping : abc.com : System error

How do I fix this?

There is a static entry for abc.com on the palo alto

Re: Palo Alto unable to resolve its own static entries

mshekh — Tue, 04 Feb 2025 04:29:59 GMT

Hi @ciscojuniperf5 ,

Thanks for info however provided info is not enough to comment on resolution however please refer the below kb for more details related to configuration as it looks like some configuration issue.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFcCAK

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClLxCAK

Re: Palo Alto unable to resolve its own static entries

ciscojuniperf5 — Tue, 04 Feb 2025 11:30:42 GMT

Hi @mshekh

Those settings are same on a firewall where it is working and this firewall where it not working. I am confused now as to where is the issue.

Re: Palo Alto unable to resolve its own static entries

ciscojuniperf5 — Tue, 04 Feb 2025 11:33:30 GMT

Its a PA-440 on version 11.2.4-h1

Re: Palo Alto unable to resolve its own static entries

mshekh — Wed, 05 Feb 2025 01:16:33 GMT

Hi @ciscojuniperf5 ,

Thanks for info, please open a support case and work with TAC team for further investigation if settings are correct.

Re: Palo Alto unable to resolve its own static entries

emr_1 — Wed, 05 Feb 2025 07:08:17 GMT

At least you need to take care of two locations.

One is DNS proxy as mentioned in previous post:

Secondary, you need to configure to use dns proxy by system (pan device itself) as below:

Here is my result:

====

admin@PA-455> ping host abcsampledomain.com <<< Before configuring above two
ping: abcsampledomain.com: System error

admin@PA-455> show dns-proxy static-entries all

Name: dnsproxy
Static Entries: 2
Domain IP/Name Type Class TTL Hits Static
-----------------------------------------------------------------------------------------------------------------------------
4.3.2.1.in-addr.arpa abcsampledomain.com PTR IN 0 0 config
abcsampledomain.com 1.2.3.4 A IN 0 0 config

admin@PA-455> ping host abcsampledomain.com <<< After configuring above two
PING abcsampledomain.com (1.2.3.4) 56(84) bytes of data. <<< you can see IP address

====

Re: Palo Alto unable to resolve its own static entries

ciscojuniperf5 — Wed, 05 Feb 2025 12:33:21 GMT

I have these configured similar on both working and non working firewall

Re: Palo Alto unable to resolve its own static entries

mshekh — Fri, 07 Feb 2025 03:19:30 GMT

Hi @ciscojuniperf5 ,

I will suggest you to open a tac case and work with Tac team to troubleshoot further.