Why Management interface do query instead of DNS-Proxy Interface

akilan.r@tutelartechlabs.com.panwpartner — Thu, 16 Feb 2023 17:51:19 GMT

Hi Team,

I configured DNS proxy Interface e1/1 - 192.168.29.245 to clientless vpn.

DNS-Proxy resolves as,

General browsing resolves with DNS 8.8.8.8 and 1.1.1.1
Tutelartechlabs.com resolves with DNS 1.1.1.2 and 4.4.4.4
Amazon.forest.in (internal-application) resolves with DNS 172.30.30.31

Note:

DNS-Proxy interface is the interface that act as a proxy and queries for dataplane traffic instead of management interface setup-->service-->DNS.

so the question is why my management interface 192.168.29.250 queries for amazon.forest.in to the DNS server when the application is accessed by a user in clientless-vpn instead of my DNS-Proxy Interface 192.168.29.245.

I have attached both pcaps from server and the firewall.

Re: Why Management interface do query instead of DNS-Proxy Interface

nikoolayy1 — Mon, 20 Feb 2023 09:22:56 GMT

If you have correctly also attached the DNS proxy under the "Proxy" tab in the Clientless VPN then it could be a bug because you have the managment ip address in the same subnet as the data interface and I think that there was such an issue but I can't say for 100%.

Test if also configuring the service route for DNS to use the data plane interface will help or if possible to place the data plane interface in seperate subnet than the managment interface.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/service-routes

topic Why Management interface do query instead of DNS-Proxy Interface in Next-Generation Firewall Discussions

Why Management interface do query instead of DNS-Proxy Interface

Re: Why Management interface do query instead of DNS-Proxy Interface