topic Re: Unable to resolve FQDN after upgrading PAN OS to 10.1.5 - " ping: unknown host FQDN" in General Topics

Unable to resolve FQDN after upgrading PAN OS to 10.1.5 - " ping: unknown host FQDN"

Shakemustafa — Thu, 16 Jun 2022 11:38:20 GMT

Hi Every one,

We have recently upgraded PA-820 to PA-OS 10.1.5. After that, we observed we cannot resolve any FQDN from the firewall.

*. We have verified the DNS setting Device>Setup>Services> Primary as 8.8.8.8 and local.

*. We have tested by changing the service route of DNS to LAN, WAN, and default and allowed complete access in policy still no use.

*. We have restarted MGMT server and DNS-Proxy process but still, no use getting errors as " ping: unknown host FQDN"

* Also observed it is working file in machines behind this firewall. Only unable to resolve from firewall CLI.

Can anyone please help me to address this issue.

Re: Unable to resolve FQDN after upgrading PAN OS to 10.1.5 - " ping: unknown host FQDN"

JuanRodriguezIT — Thu, 16 Jun 2022 16:44:35 GMT

you're not alone on this one i am running 10.1.5. i have been dealing with this issue for the past week or so. I am looking at upgrading to 10.1.6 since it was recently approved as the preferred release. my set up is pretty simple it's only a palo 440 trunked to a cisco 2960xr. i have thrown just about everything at it and still no luck.

Re: Unable to resolve FQDN after upgrading PAN OS to 10.1.5 - " ping: unknown host FQDN"

OtakarKlier — Thu, 16 Jun 2022 17:09:51 GMT

Hello,

Looks like 10.1.6 is the prefered release. I'm running it and have not seen the issue you are describing.

https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304

Regards,

Re: Unable to resolve FQDN after upgrading PAN OS to 10.1.5 - " ping: unknown host FQDN"

Shakemustafa — Thu, 16 Jun 2022 17:14:36 GMT

@JuanRodriguezIT and @OtakarKlier : Thanks for your reply. Is there any other workaround except the PAN-OS upgrade?

Re: Unable to resolve FQDN after upgrading PAN OS to 10.1.5 - " ping: unknown host FQDN"

JuanRodriguezIT — Thu, 16 Jun 2022 18:25:35 GMT

if you don't want to upgrade i would go back to the previous version. i am looking at upgrading to 10.1.6 but obviously needs to be done after hours. @OtakarKlier mentioned he has no issues so I am hoping that will fix my issue because as i mentioned I've hit this thing from all angles except downgrading or upgrading 😞

Re: Unable to resolve FQDN after upgrading PAN OS to 10.1.5 - " ping: unknown host FQDN"

Shakemustafa — Mon, 11 Jul 2022 14:38:29 GMT

Hi,

I have upgraded the PAN-OS to 10.1.6, But still the Same Issue, Unable to resolve FQDN getting " Unknow Host: www.google.com".

Need Help to address the issue.

Re: Unable to resolve FQDN after upgrading PAN OS to 10.1.5 - " ping: unknown host FQDN"

OtakarKlier — Mon, 11 Jul 2022 19:05:24 GMT

Hello,

I would say opening a support case would be in order. I'd be interested to see what they have to say.

Regards,

Re: Unable to resolve FQDN after upgrading PAN OS to 10.1.5 - " ping: unknown host FQDN"

Shakemustafa — Wed, 13 Jul 2022 12:32:31 GMT

Hi @OtakarKlier :

PA TAC Update is :

This behavior is observed on PAN 10.1.6.There is no target fix for this bug.

As the resolution is either remove the domain name (if not required) and if required then there should not be any space.
PAN-196841 will be fixed as with same configuration we observed that content and dynamic updates working fine on PAN OS 10.1.3.
The issue was due to invalid domain string name configured on the firewall under General setting>>Domain.
Device --> Setup --> Management --> General Settings --> Domain -->
+We removed the domain and issue got fixed.

Recently there was a fix added to validate all hostname/domain name strings from sysdagent. Hence quite possible that this string was accepted in earlier versions

Re: Unable to resolve FQDN after upgrading PAN OS to 10.1.5 - " ping: unknown host FQDN"

SARowe_NZ — Wed, 21 Sep 2022 07:20:41 GMT

Further to this I have found it only seems to affect Panorama-pushed config. In testing this did not impact us when the domain name was entered locally on the firewall rather than being pushed from Panorama.

Re: Unable to resolve FQDN after upgrading PAN OS to 10.1.5 - " ping: unknown host FQDN"

JuanRodriguezIT — Wed, 21 Sep 2022 14:01:46 GMT

Hello, may i ask what Pan-OS are you running? I had to go down to 10.1.4h4 to make this fqdn issue resolved.

Re: Unable to resolve FQDN after upgrading PAN OS to 10.1.5 - " ping: unknown host FQDN"

SARowe_NZ — Wed, 21 Sep 2022 19:19:20 GMT

We are on PANOS 10.1.6-h6