topic Re: dns proxy - static entries in General Topics

dns proxy - static entries

FlexyZ — Wed, 09 Nov 2011 08:43:08 GMT

I have a dns proxy on one of my interfaces with some static entries, but nothing is resolved on the static ones - they should have a higher priority than the primary dns IP right?

Thanks

Re: dns proxy - static entries

gswcowboy — Wed, 09 Nov 2011 09:28:43 GMT

Provide output from the following commands:

> show dns-proxy cache all
> show dns-proxy settings all
> show dns-proxy static-entries all
> show dns-proxy statistics all

Re: dns proxy - static entries

FlexyZ — Wed, 09 Nov 2011 10:01:44 GMT

hmm my issues seems to be related to windows - I have no DNS suffix in my DNS client configuration

PA-500:

DNS proxy -> d1 -> test -> 10.10.10.10

DNS proxy -> d2 -> test.test -> 20.20.20.20

Windows 7 and Windows Serer 2008 ->

ping test.test -> 20.20.20.20

ping test -> nothing resolved

ping test. -> 10.10.10.10

ping test -> 10.10.10.10

This is kind of weird I think - my goal is to specify static hosts that all clients should resolve - Any clues are very welcome!

Thanks

Re: dns proxy - static entries

sspringer — Sun, 27 Nov 2011 04:00:40 GMT

It is possible windows is modifying the DNS request by adding its own suffix. Please gather PCAPs from the Windows machine to verify the DNS query.

Also you have made a post that some static DNS proxy entries are not working (https://live.paloaltonetworks.com/thread/3778) - When you were performing these tests did you verify the static entries were present on the PAN?

Regards,

Stefan

Re: dns proxy - static entries

FlexyZ — Mon, 28 Nov 2011 13:09:18 GMT

disable/enable showed the static entries again from the CLI, but then the DNS-Proxy in general didnt work.

I tried to from eth(s), commit and added them again, commit - but no luck

So I had to reboot firewall - and when it came up still no go - until I noticed it was not enabled (even though I did it before reboot)

Enable fixed it - I have opened a support case, but is going though a partner, so not very responsive.

Thanks

Re: dns proxy - static entries

FlexyZ — Mon, 28 Nov 2011 13:13:33 GMT

sorry wrong case

should be https://live.paloaltonetworks.com/message/10956#10956

This is been resolve by added static entries with 2 levels xxxx.yyy.com etc. and adding yyy.com suffix in DHCP scope