topic Fast DNS Resolution Issues in General Topics

Fast DNS Resolution Issues

OtakarKlier — Tue, 17 May 2022 21:31:33 GMT

Hello Community,

I checking to see what everyone is doing for their allow lists for some thing like an S3 bucket.

Scenario: Lets say my server has no internet access due to policies denying the traffic. I then create an object, FQDN, xyz-s3.amazon[.]com (just as an example), add it to a policy that allows my server to access just that s3 bucket.

Problem: Most of the CDN (Content Delivery Network) providers use FAST DNS switching, which in some cases causes DNS caching issues. This happens because of quick changing FQDNs at the CDN side.

Solutions?

Set the minimum FQDN Refresh timer(sec) to 0 (Zero) https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/networking-features/fqdn-refresh-response

Anyone doing this and have you seen any issues? Are you doing something else that is working? I know about custom URL's and plan on doing this as well, however there are many instances where the URL filter will not be hit, ie not a HTTP request.

Thanks in advance for your input.

Cheers!

Re: Fast DNS Resolution Issues

Adrian_Jensen — Wed, 18 May 2022 19:44:06 GMT

I have had the same problem, with fast-flux DNS, and I haven't come up with a good solution. The 0 refresh timer hasn't seemed to be a fix. The problem is 2-fold; one that the DNS TTL is very short, the second that the returned records are a constantly changing subset among a larger group. So you can never be sure that the PA got the same DNS response as the client (particularly if you have multiple DNS servers) and even if the PA and client do get the same DNS right now, 30sec from now the PA will refresh and get a new IP, while the client will still be connected on the old IP (no longer matching the FQDN).

We have several case where data providers are using data stores on Amazon/Salesforce clusters with fast-flux DNS. A Java app then connects to the data store to pull data... but that breaks on SSL decryption, because the app uses an internal CA certificate store instead of the PC's store, and I can't correctly exempt it from decryption do to the DNS issues. Where I can I have used URL filters instead of address objects, and that seems to work well. Where the traffic isn't HTTP I have had to write a bash script to repeatedly query/build a list of every IP on the fast-flux cluster and then add that as an address group to bypass. Less than idea and every few weeks to months it breaks and has to be redone.

Re: Fast DNS Resolution Issues

BPry — Wed, 18 May 2022 21:11:51 GMT

@OtakarKlier,

I haven't found a great way of dealing with these sort of situations. If you use FQDN you'll occasionally have things get out of sync between the firewall and the client (which may not matter depending on requirements), and URL Categories as you mentioned will only work with a HTTP request.

I've been using EDLs as a solution for this and using an external script to feed addresses for the EDL with the firewall. The firewall only supports updating the EDLs every fine minutes, but you can speed that up by dropping it to manual and using the API to request the refresh of the EDL on a more frequent basis. Not really solving the issue, but it gets closer to working without as many issues.