topic Re: nslookup on the management port ? in General Topics

nslookup on the management port ?

DSTR — Wed, 11 Jun 2014 17:58:19 GMT

I would like to check a few DNS issues I'm seeing on the management port.

I had hoped to find nslookup in the CLI, but it isn't there.

Is there something equivalent ?

Thanks.

Re: nslookup on the management port ?

gwesson — Wed, 11 Jun 2014 19:43:51 GMT

There is no nslookup command, but you can do a simple ping. Even if the destination doesn't allow ping, the DNS lookup will still happen. The command to ping from the management interface is:

ping host www.example.com

You will want to ensure that you are not using a service route though, as the DNS requests are all sent using that service route. The service routes are configured at Device > Setup > Services > Service Route Configuration. If you do have a service route set, your ping and all DNS lookups where the firewall initiates connections (such as updates.paloaltonetworks.com) will use that route.

Hope this helps,

Greg

Re: nslookup on the management port ?

HULK — Wed, 11 Jun 2014 19:47:34 GMT

Hello DSTR,

As per my knowledge, PAN CLI does have an option like "nslookup" in windows. But, you can verify the DNS functionality, wthere FQDN resolves to a valid IP address from the DNS server.

admin> ping host google.com

PING google.com (173.194.115.70) 56(84) bytes of data. >>>>>>>>>>>>>>>>>>>>> Configured DNS server resolved the FQDN address to IP address.

64 bytes from dfw06s41-in-f6.1e100.net (173.194.115.70): icmp_seq=1 ttl=55 time=40.6 ms

64 bytes from dfw06s41-in-f6.1e100.net (173.194.115.70): icmp_seq=2 ttl=55 time=37.1 ms

64 bytes from dfw06s41-in-f6.1e100.net (173.194.115.70): icmp_seq=3 ttl=55 time=39.4 ms

Thanks

Re: nslookup on the management port ?

Royalfr — Mon, 17 May 2021 15:58:36 GMT

If you HTTPS to the firewall and create an Address as an FQDN instead of an IP, there is a clickable RESOLVE link next to where you place the DNS name. That will resolve and list all the IP addresses it pulled from DNS. This is better than a PING test as PING will only show the first of many IPs. Using the FQDN address object you can see the full list.

Re: nslookup on the management port ?

Kobiher — Fri, 05 Jan 2024 07:46:39 GMT

great solution that replaces nslookup perfectly, thank you 🙂