topic Re: Variables is DNS Proxy rule? in General Topics

Variables is DNS Proxy rule?

PozsonyiAttila — Wed, 22 Sep 2021 12:51:54 GMT

Hi,

My question would be, is it possible to use template variables to set primary end secondary dns for DNS proxy rules in Panorama?

I can set a static entrys' IP address value to a variable defined in the template, but can't find the way to do the same for proxy rules.

Context: Our branch offices each have their on subnet, doman controllers and Palo Alto FWs. Subnets and IP addresses are standarized, Office 1 DC1 has IP of 192.168.1.1, Office2 DC1 has 192.168.2.1, etc. The DCs have their own template variable, let's say $DC01

The clients use the firewalls DNS proxy for DNS queries, however I want some queries for specific domains to be forwarded to the local DC, instead of the primary DNS server of the DNS proxy.

Of course I can override the configuration of the DNS Proxy object on the local firewall, but I would like to avoid that, it would make the template variables and the whole central management concept unusable.

Thanks in advance

Regards

Re: Variables is DNS Proxy rule?

PavelK — Sat, 25 Sep 2021 22:46:30 GMT

Thank you for posting question @PozsonyiAttila

I was looking into this on my side, but I can't see this option in Panorama either. As an alternative solution, I would suggest to create a new Template for every site and configure the DNS proxy object in it, then place it on the top in each site's Template Stack. In this case, the DNS proxy object would take precedence and rest of the configuration will be pushed from rest of your Templates in Template Stack. This will have a slight administrative advantage over overriding Template values locally on Firewall side and you can manage everything from Panorama side.

Kind Regards

Pavel

Re: Variables is DNS Proxy rule?

PozsonyiAttila — Mon, 04 Oct 2021 13:48:16 GMT

Thanks for your answer Pavel,

If I'd have a tempIate stack for every branch office it could have been a solution, but our infrastructure and IP addressing is highly standartized so I could do all my 60+ sites with a single template stack and variables. So far...

In think it's a pretty basic need to handle DNS servers with variables or it's only me?

Anyway, I think I file a feature request and see what PAN thinks about it.

Kind regards,

Attila

Re: Variables is DNS Proxy rule?

LucG — Wed, 13 Apr 2022 17:00:17 GMT

I am in the exact same situation and I don't understand why we can't use variables in there! Did you create a feature request ?

Re: Variables is DNS Proxy rule?

JasonPeterson — Fri, 04 Nov 2022 18:11:33 GMT

Running into this as well. Our template sets all the interfaces in vsys1. If you create the DNS Proxy Object on the template in Vsys1 it let's you define variables. However, when you go to commit to the firewalls it fails and says the interfaces are an invalid reference which doesn't make sense as they live in the default vsys1.

Re: Variables is DNS Proxy rule?

B.Pozdech — Thu, 24 Apr 2025 14:24:58 GMT

Hello! Were you able to overcome this issue? I face it too and variables are perfect example how to solve it.