DNS traffic allowed for one server but dropped for another

Mitre10 — Wed, 25 Nov 2015 02:36:32 GMT

I have a perplexing problem with allowing DNS traffic from internal to the internet on our new PA-3020 running 7.0.3.

We have 2 DNS servers in our datacentre on the same subnet that perform queries to a couple of external DNS servers provided by our telco.

I have a rule allowing traffic from the 2 IP's (Internal Zone) for our DNS servers out to the internet (any) on UDP port 53

One server is successfully using this rule but the other server bypasses the rule and gets blocked by the explicit deny at the bottom. The traffic log shows the correct port (53) but the application is "not-applicable". I've tried the following "application/service" settings but there is no change to the issue:

Application: any Service UDP 53

Application: dns Service: application-default

Application: dns Service UDP 53

I've done packet captures on the server that's not working and the destination port for the traffic is UDP 53 so I'm at a real loss to know why this is happening. Can anyone assist me here please?

Thanks!

Re: DNS traffic allowed for one server but dropped for another

BenjAudy.MTL — Wed, 25 Nov 2015 05:12:16 GMT

Hi,

If the application is not-applicable, it means the firewall didn't even bother trying to identify the application because no rule with the protocol/port matched the packet. Are you sure the blocked traffic is not TCP? DNS can be UDP or TCP, so you should just use application default in the case of DNS. Alternatively, add another service for TCP port 53.

Regards,

Benjamin

topic DNS traffic allowed for one server but dropped for another in General Topics

DNS traffic allowed for one server but dropped for another

Re: DNS traffic allowed for one server but dropped for another