topic FQDN Address Objects Not Resolving - PANOS 6 in General Topics

FQDN Address Objects Not Resolving - PANOS 6

SDorsey — Wed, 16 Jul 2014 13:55:03 GMT

I have a few different clients with the same issue.

I have some FQDN address objects and I assign a TAG to each of those objects. Then I create a Dynamic address object group which contains address objects with that tag. Then I add the dynamic group to a policy.

Traffic is not matching on that policy; it is matching on explicit deny rule.

If I run "request system fqdn show", I get:

sharepoint.domain.org (Objectname SharePoint):

Not used

From the PAN, I can surely resolve the specific names. It just isn't storing them in the object db it appears. If I change the address object group to a static group and add the address objects manually as opposed to tagging/dynamic, it works fine.

Re: FQDN Address Objects Not Resolving - PANOS 6

Wenar — Wed, 16 Jul 2014 14:43:36 GMT

If you are on PanOS 6 it's a known issue. I have already a case open for this. It will be fixed in 6.1 (not 6.0.X at the moment)

Edit: Bug ID is 64223

Re: FQDN Address Objects Not Resolving - PANOS 6

HULK — Wed, 16 Jul 2014 14:52:55 GMT

The above mentioned symptoms is looks like Bug - "FQDN objects in Dynamic address group show up as not used when doing 'request system fqdn show".

Few related discussion on the same topic:

not resolved

Unresolved FQDNs in Security Policy Result in Shadow Policy Warning During Commit

FQDN Table in CLI

Hope this helps.

Thanks

Re: FQDN Address Objects Not Resolving - PANOS 6

SDorsey — Wed, 16 Jul 2014 18:58:55 GMT

Thanks! Do you have any idea when 6.1 may drop? I thought it was the end of this year and that seems like a bit to wait for this bug fix.

Re: FQDN Address Objects Not Resolving - PANOS 6

HULK — Wed, 16 Jul 2014 19:10:48 GMT

You may ask to your Palo Alto SE for the same. Also, you may convey your requirement to get it fixed in 6.0.x release ( if possible).

Thanks

Re: FQDN Address Objects Not Resolving - PANOS 6

Wenar — Thu, 17 Jul 2014 12:58:35 GMT

I'm still waiting for a response if it will be fixed in an earlier release. I will post it here if I get an answer.

Re: FQDN Address Objects Not Resolving - PANOS 6

pulukas — Thu, 17 Jul 2014 21:41:01 GMT

Wenar Thanks for the bug id and the follow up.

Re: FQDN Address Objects Not Resolving - PANOS 6

Wenar — Thu, 13 Nov 2014 14:49:09 GMT

I got the information that this bug will be fixed in version 6.0.7