Firewalls is not resolving domain names in address groups

LimaSupport — Mon, 19 Dec 2022 09:11:23 GMT

For some odd reason the firewall is not resolving external fqdn's that are part of an Address groups..

Re: Firewalls is not resolving domain names in address groups

Arnesh — Mon, 19 Dec 2022 10:31:33 GMT

Can you describe how do you confirm the firewall is unable to resolve the domains? Have you checked it from the GUI or CLI of firewall?

Mostly, the reason for the firewall not able to resolve the FQDNs is due to the firewall unable to reach the DNS server.

By default, mgmt interface is used to connect to the DNS server (but can be changed from Device > Setup > Services > Service Route Configuration)

You can check if the DNS server is reachable. The CLI command below can then be used to view the list of FQDN objects and the IP addresses associated with that name.

PAN-OS 8.1 and below: > request system fqdn show
PAN-OS 9.1 and above: > show dns-proxy fqdn all

Alternatively, you can also check the FQDN resolution on the GUI by navigating to Address Objects > Select the FQDN Address Object in question > Click on 'resolve'.

Please go through the below KBs, which can be of help:

How to Configure and Test FQDN Objects
DNSPROXY and FQDN address refresh behaviours - PANOS 9.0 and Above

Regards,

Re: Firewalls is not resolving domain names in address groups

Arnesh — Mon, 19 Dec 2022 10:33:12 GMT

Have you also tried/checked if the DNS server (also configured on firewall) is able to resolve the external domains?

Regards,

topic Re: Firewalls is not resolving domain names in address groups in General Topics

Firewalls is not resolving domain names in address groups

Re: Firewalls is not resolving domain names in address groups

Re: Firewalls is not resolving domain names in address groups