topic Re: Paloalto cannot resolve specific FQDN through Nslookup & "fqdn refresh" is not working on CLI console in General Topics

Paloalto cannot resolve specific FQDN through Nslookup & "fqdn refresh" is not working on CLI console

JoHyeonJae — Wed, 23 Nov 2022 06:11:52 GMT

Hello all,
Our client company uses FQDN A and B that Nslookup the same IP, and the firewall has a DNS access policy applied with these FQDN.

Recently, the customer deleted the DNS of B, and if it is normal operation, it should be normal service with FQDN of A, but DNS blocking issue occurred.

In addition, entering FQDN refresh from the CLI does not apply, and only when a commit is made through the GUI, the IP permit policy lookup to domain B of the actual device is applied.

It is confirmed that the policy is applied after committing through the GUI console, but I want to know why it is not applied when you try "fqdn refresh" in the CLI.

I tried to run "request system fqdn refresh force yes", but it was not working.

Best and Regards,

Re: Paloalto cannot resolve specific FQDN through Nslookup & "fqdn refresh" is not working on CLI console

kiwi — Wed, 23 Nov 2022 08:19:03 GMT

Hi @JoHyeonJae ,

Hard to say what caused it with the information at hand but maybe the FQDN refresh job was failing:

FQDN Refresh Job Fails

Kind regards,

-Kiwi.

Re: Paloalto cannot resolve specific FQDN through Nslookup & "fqdn refresh" is not working on CLI console

JoHyeonJae — Fri, 25 Nov 2022 00:29:35 GMT

Hi @kiwi

I think FQDN reload does not appear to have failed. Because the output related to FQDN refresh could not be found in the result of show jobs all.

Show jobs all -> there is no any FQDN refresh log like FQDN refresh failed, FQDN Refresh job successful, and so on.