topic New DNS configuration issue in General Topics

New DNS configuration issue

Raghav_B — Wed, 28 Dec 2016 17:47:33 GMT

Hi All,

I have coinfigured a new DNS server on Palo Alto device. However, it is still sending queries to the old DNS servers.

Please help.

Regards,

Raghav

Re: New DNS configuration issue

BPry — Wed, 28 Dec 2016 19:25:10 GMT

Where exactly are you trying to setup DNS? Is this for DNS Proxy, the DNS for the firewall as a whole? Not alot to go off of here since I'm not sure which one your actually talking about but it sounds like you either haven't committed the change, added the new DNS server as a secondary, or for some reason it's keeping a session open with your old DNS server and using that session to query any new requests.

Re: New DNS configuration issue

TranceforLife — Thu, 29 Dec 2016 10:45:22 GMT

+1 @BPry most likely changes are not committed

Re: New DNS configuration issue

Raghav_B — Thu, 29 Dec 2016 11:09:06 GMT

I have added a new DNS server as a primary DNS server on firewall, secondary DNS address is kept same on firewall.

Ans it is not DNS proxy, just a normal DNS server address that is added to the firewall( Device > Setup > Services > DNS

Changes are committed to the device.

Re: New DNS configuration issue

Raghav_B — Thu, 29 Dec 2016 11:10:36 GMT

Changes are committed to the firewall ( Commit button is greyed out, since there is no difference between running and candidate config).

Please advise.

Regards,

Raghav

Re: New DNS configuration issue

TranceforLife — Thu, 29 Dec 2016 11:44:04 GMT

Hello Raghav,

How do you know that the firewall is using an old server rather than the new? Do you see traffic logs or got a PCAP from the firewall

Thx,

Myky

Re: New DNS configuration issue

kdd — Thu, 29 Dec 2016 12:09:44 GMT

Hello Raghav,

please verify also the "Service Route Configuration" for your DNS-Server. You will find it here: Device > Setup > Services > Global > Services Features.

Regards,

Klaus

Re: New DNS configuration issue

Raghav_B — Thu, 29 Dec 2016 13:03:46 GMT

I don't see logs on Monitor tab, however when I get a PCAP - I see only old DNS server hostname. Also DNS confirmed that firewall is querying old DNS server.

Regards,

Raghav

Re: New DNS configuration issue

Raghav_B — Thu, 29 Dec 2016 13:05:34 GMT

Service Route Configuration is not changed, it is default through Management port for DNS traffic. I can try changing the route of DNS traffic to any in-band port and confirm.

But I don't see this to be the issue.

Please guide.

Regards,

Raghav

Re: New DNS configuration issue

TranceforLife — Thu, 29 Dec 2016 13:22:01 GMT

Hi,

You are correct. Service route option will change the way you get to the specific source/destination.

Don't really know how this happens but the firewall will alway do exactly what you told it to do but this is not always what we want)))

P.S I just tested on my firewall and it does the same, talking to the old DNS server. Getting more interesting)

Thx,

Myky

Re: New DNS configuration issue

kiwi — Thu, 29 Dec 2016 13:26:21 GMT

Hi @Raghav_B,

Are you by any chance using an older PAN-OS version ?

From the PAN-OS 7.1.2 release notes (Addressed issues) :

The firewall does not update some processes as expected (such as mgmtsrvr, reportd, logd, and pan_log_receiver) when you specify a new DNS server (Device > Setup > Services [> Global]), which causes the firewall to continue forwarding some DNS requests to the previously configured DNS server instead of the current one.

Cheers,

-Kim.

Re: New DNS configuration issue

TranceforLife — Thu, 29 Dec 2016 13:36:37 GMT

Hi,

I am on 7.1.6 so l restarted a data plane and it seems like resolved the issue. Now l can see queries are going to the new DNS.

@Raghav_B what is your version?

Thx,

Myky

Re: New DNS configuration issue

Raghav_B — Fri, 30 Dec 2016 11:10:34 GMT

Thanks Myky, I am going to upgrade to 7.1.6, then restart the data plane. Will keep you posted, if issue persists.

Regards,

Raghav

Re: New DNS configuration issue

Raghav_B — Fri, 30 Dec 2016 11:35:53 GMT

I am running on PAN OS 7.1.2, let me upgrade to 7.1.6. I will check and keep you updated.

Thanks for the information, really helpful :).

Regards,

Raghav

Re: New DNS configuration issue

TranceforLife — Fri, 30 Dec 2016 11:39:15 GMT

Hiya,

If you will perform an update you have to reboot the box in order for the new PAN-OS take effect. So no need to reboot data plane after.

Good luck,

Myky

Re: New DNS configuration issue

Raghav_B — Fri, 30 Dec 2016 13:00:32 GMT

Yep. 🙂

Raghav