topic Re: "Non-existent domain" error with split tunnel for "Both Network traffic and DNS" in General Topics

"Non-existent domain" error with split tunnel for "Both Network traffic and DNS"

Carracido — Thu, 23 Feb 2023 14:37:23 GMT

Dear community!

I have configured split tunnel for both Both Network traffic and DNS and it works fine. However while doing nslookups I get the "Non-existent domain" error

According to the document down below, this can be fixed by setting "Resolve "All" FQDNs Using DNS Servers Assigned by the Tunnel (Windows Only)" option to NO. This option is already configured but we are seeing the issue anyways.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HB0rCAG&lang=en_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Any idea why this is happening?

Thank you!

Re: "Non-existent domain" error with split tunnel for "Both Network traffic and DNS"

TomYoung — Fri, 24 Feb 2023 23:11:31 GMT

Hi @Carracido ,

More information is needed to assist. Are you doing an nslookup on the FQDN? If not, have you populated the DNS Suffix field in the GlobalProtect gateway Agent > Network Services?

Thanks,

Tom

Re: "Non-existent domain" error with split tunnel for "Both Network traffic and DNS"

Carracido — Mon, 27 Feb 2023 12:21:24 GMT

Hello @TomYoung

Yes, I´m doing nslookup on the fqdn.

Regards.

Re: "Non-existent domain" error with split tunnel for "Both Network traffic and DNS"

Raido_Rattameister — Mon, 27 Feb 2023 14:40:52 GMT

By default "Resolve "All" FQDNs Using DNS Servers Assigned by the Tunnel (Windows Only)" is enabled.

This means that nslookup works only towards DNS servers that are configured in GlobalProtect gateway config.

If you set this option to NO then by default it can take 24 hours before GP agent refreshed config and starts permitting DNS requests against other DNS servers.

You can refresh manually from GP agent menu by choosing "Refresh Connection".