topic Re: Can't create DNS Proxy using Panorama in General Topics

Can't create DNS Proxy using Panorama

Marivi — Fri, 13 Apr 2018 22:07:57 GMT

ISSUE

When try to configure DNS Proxy with panorama after commit we get next message error:

dns-proxy -> xxxxx-> server-profile 'yyyyy' is not a valid reference
dns-proxy -> LAN_speedup -> server-profile is invalid

xxxxx ->dns proxy configured

yyyyy ->server dns profile created

RESOLUTION

The DNS server profile was added as a feature primarily for the config of DNS proxy under Virtual Systems configuration. Hence this is virtual system specific setting which is what we currently have designed it for.

the recommendation is to choose the location as Shared for now to ensure commits work properly.

If your device don't support Multi Vsys, you try next workaround:

- Disable multi vsys in panorama
- Now, create a DNS proxy object or a different template with DNS proxy object so that it could be used for those firewalls which does not have multi vsys or not enabled it
- Now, turn on the multi vsys feature on Panorama
- (if you have other fw which support multi vsys) Create new DNS proxy object or new template with DNS proxy object so that it can be used to push to the firewalls having multi vsys environment.

Re: Can't create DNS Proxy using Panorama

GaryOssewa — Mon, 01 Feb 2021 21:40:54 GMT

I've had this same issue, still on 9.0.9 code. Is this fixed in a later version?

Re: Can't create DNS Proxy using Panorama

dkane66 — Fri, 13 May 2022 15:27:56 GMT

I am running 10.1.4 and you still need to disable the MultiVsys option for this within Panorama.

Re: Can't create DNS Proxy using Panorama

ederg — Tue, 11 Oct 2022 08:52:20 GMT

Still in here in 10.2.3., with MultyVsys enabled.

Re: Can't create DNS Proxy using Panorama

JasonPeterson — Fri, 04 Nov 2022 17:37:26 GMT

If you create your proxy as shared, then we are unable to use variables for the DNS Servers, which then requires a static config. Anyway around this?

Re: Can't create DNS Proxy using Panorama

LucG — Thu, 27 Jul 2023 09:32:44 GMT

Yes, I agree we then can't use variables which is very cumbersome as then we need to create a Proxy_DNS template per FW with the correct values...

Re: Can't create DNS Proxy using Panorama

dkane66 — Thu, 27 Jul 2023 14:25:16 GMT

I lucked out on this one as all of my devices that are using DNS Proxy only have a single VSYS. That has allowed me to create a Template that has DNS proxy within it. I did have to create an individual template for each region, this means I only have 5 or so templates to update instead of hundreds. Best thing you can do is try to limit the pain by either creating a specific template just for DNS proxy for all of your devices and just overriding the parts that need it in the xstack.