topic Re: FQDN jobs FAILED in General Topics

FQDN jobs FAILED

Es_tecsupportsecurity — Tue, 25 Apr 2017 11:41:14 GMT

Hi,

We have added several FQDN objects and its not working. If we run

update.symantec.com (Objectname update.symantec.com):

Not resolved

us.archive.ubuntu.com (Objectname us.archive.ubuntu.com):

Not used

xxxxxxx (Objectname HOST_xxxx13):

Not resolved

2017/04/25 13:35:54 29960 FqdnRefresh FIN FAIL 13:36:04
2017/04/25 13:31:44 29959 FqdnRefresh FIN FAIL 13:31:53
2017/04/25 13:30:32 29958 WildFire FIN OK 13:30:34
2017/04/25 13:30:25 29957 Install FIN OK 13:30:32
2017/04/25 13:30:23 29956 Downld FIN OK 13:30:25
2017/04/25 13:24:28 29954 FqdnRefresh FIN FAIL 13:24:39
2017/04/25 13:15:33 29953 WildFire FIN OK 13:15:37
2017/04/25 13:15:25 29952 Install FIN OK 13:15:33

Why PA is getting errors in FQDN jobs?? we dont see any details or info. We can reach DNS servers and everything.

show jobs id 29959

Enqueued ID Type Status Result Completed

2017/04/25 13:31:44 29959 FqdnRefresh FIN FAIL 13:31:53
Warnings:
Details:

Re: FQDN jobs FAILED

BPry — Tue, 25 Apr 2017 12:40:44 GMT

@Es_tecsupportsecurity,

What does your output look like if you run request system fqdn refresh force yes in CLI? Generally this would mean that you can't actually resolve the domain on your local DNS server if that is what you are using as the Palo Alto's DNS settings. On whatever DNS server(s) you are using on the Palo Alto just verify that they themselves can actually resolve those domain names.

Re: FQDN jobs FAILED

Es_tecsupportsecurity — Tue, 25 Apr 2017 13:12:18 GMT

i tried with force but error is the same. If i ping this domain from PA is resolving the IP correctly. Anyway i dont know if this job should fail although DNS cant resolve this domain.

Re: FQDN jobs FAILED

TranceforLife — Tue, 25 Apr 2017 13:23:29 GMT

request system fqdn refresh

request system fqdn show

What can you see? Can you please tell us your PAN-OS as well as hardware platform

Re: FQDN jobs FAILED

Es_tecsupportsecurity — Tue, 25 Apr 2017 13:26:48 GMT

I tried but job is failing

Enqueued ID Type Status Result Completed
--------------------------------------------------------------------------
2017/04/25 15:24:35 29993 FqdnRefresh FIN FAIL 15:24:46
2017/04/25 15:20:27 29992 FqdnRefresh FIN FAIL 15:20:40

and not resolving any domain in "request system fqdn show"

but if i run a ping from PA the domain is solved

captive.apple.com (Objectname captive_apple):

Not resolved

---

ping host captive.apple.com
PING captive.g.aaplimg.com (17.253.35.208) 56(84) bytes of data.

Re: FQDN jobs FAILED

TranceforLife — Tue, 25 Apr 2017 13:28:50 GMT

@Es_tecsupportsecurity wrote:
I tried but job is failing

Enqueued ID Type Status Result Completed
--------------------------------------------------------------------------
2017/04/25 15:24:35 29993 FqdnRefresh FIN FAIL 15:24:46
2017/04/25 15:20:27 29992 FqdnRefresh FIN FAIL 15:20:40

and not resolving any domain in "request system fqdn show"

but if i run a ping from PA the domain is solved

captive.apple.com (Objectname captive_apple):
Not resolved

---
ping host captive.apple.com
PING captive.g.aaplimg.com (17.253.35.208) 56(84) bytes of data.

Your PAN-OS and hardware platform, please;)

Re: FQDN jobs FAILED

Es_tecsupportsecurity — Tue, 25 Apr 2017 13:47:25 GMT

PA3050 PanOs 7.0.6

Re: FQDN jobs FAILED

TranceforLife — Tue, 25 Apr 2017 13:50:50 GMT

Thanks. Need to check a release notes but on the meantime may I ask you if you did try to reset a management server?

> debug software restart process management-server

Re: FQDN jobs FAILED

Es_tecsupportsecurity — Tue, 25 Apr 2017 14:20:31 GMT

I just restart mgmt server and the result is the same, i see the FQDN refresh jobs FAILED.

2017/04/25 16:15:00 2 FqdnRefresh FIN FAIL 16:15:17
2017/04/25 16:13:48 1 FqdnRefresh FIN FAIL 16:14:01

running "request system fqdn show", i see PA solve only this host connectivitycheck.android.com

FQDN Table : Last Request time Tue Apr 25 16:15:00 2017
--------------------------------------------------------------------------------
IP Address Remaining TTL Secs Since Refreshed
--------------------------------------------------------------------------------
VSYS : vsys1 (using mgmt-obj dnsproxy object)

captive.apple.com (Objectname captive_apple):

Not resolved

connectivitycheck.android.com (Objectname captive_android):

209.85.144.101 -3013295 3013353

Re: FQDN jobs FAILED

BPry — Tue, 25 Apr 2017 14:47:38 GMT

@Es_tecsupportsecurity,

That's really interesting. I don't recall anything in later 7.0.* release notes about FQDN problems, but I would update to 7.0.15 just to deal with the recent security issues and see if the issue resolves itself if you can afford the downtime if you don't have an HA pair.

Re: FQDN jobs FAILED

Es_tecsupportsecurity — Tue, 25 Apr 2017 14:56:34 GMT

I would need a strong explanation to upgrade these FWs, not upgrading just in case. Anyway im going to replicate this issue in my lab...

Re: FQDN jobs FAILED

TranceforLife — Tue, 25 Apr 2017 15:01:25 GMT

Nothing in the release notes. Just a guess really but can you try to increase update interval to 10 minutes and check if auto refresh still fails. What is happening when you type test FQDN from the GUI:

Re: FQDN jobs FAILED

Es_tecsupportsecurity — Tue, 25 Apr 2017 15:33:12 GMT

In version 7.0.6 you cant see the resolve option in WebUI, you have to use CLI.

i tried to configure 10 minutes for refresh but the result is the same 😞

Re: FQDN jobs FAILED

TranceforLife — Tue, 25 Apr 2017 15:36:25 GMT

So when you pinging the FQDNs from the CLI all looks good, it just an auto-refresh doesn't work properly... Not sure if l have missed something simple. Are you able to report this to TAC?

Re: FQDN jobs FAILED

Es_tecsupportsecurity — Thu, 27 Apr 2017 11:03:03 GMT

Exactly

admin@LukeSkywalker01(active)> ping host

i just check it in version 7.1 is working fine but not in 7.0.6 😞

Re: FQDN jobs FAILED

bradk14 — Wed, 26 Apr 2017 00:14:45 GMT

I doubt TAC will touch a 7.0.6 install. the first thing they're going to recommend is upgrading to a newer version like 7.0.15, whether it's a known issue or not.

Re: FQDN jobs FAILED

TranceforLife — Wed, 26 Apr 2017 07:41:23 GMT

I believe it is still supported release as per EOL notes so they should investigate this properly unless we are missing something simple;0

Re: FQDN jobs FAILED

Es_tecsupportsecurity — Thu, 27 Apr 2017 10:55:06 GMT

I replicated same PanOS and host FQDN in my lab and its working fine. But i dont have FQDNrefresh FAILED. :S

Re: FQDN jobs FAILED

TranceforLife — Thu, 27 Apr 2017 18:45:00 GMT

Not sure it is possible to give a firewall data plane reboot or whole box reboot. To me, it is a software issue, maybe some process stuck/crash at some point otherwise l do not have any other thoughts. I know it is not an ideal scenario but if possible give a go. Then as a next step please get in touch with TAC and see what they will suggest.

Re: FQDN jobs FAILED

Wald — Tue, 23 May 2017 18:47:35 GMT

I have the exact same issue since upgrading to Panorama 8.0.2 it causes my firewalls no matter the model or OS to go to FQDN fail after a commit. I have an open TAC case but have not found a fix. We do have a work around as follows:

The only way to get it to work is to restart the the device-server, then do a force commit and then do a fqdn force refresh.

pa5020-a(active)> debug software restart process device-server
pa5020-a(active)> configure
Entering configuration mode
[edit]
pa5020-a(active)# commit force
pa5020-a(active)# exit
Exiting configuration mode
pa5020-a(active)> request system fqdn refresh force yes