topic Re: DNS proxy to GP clients in General Topics

DNS proxy to GP clients

Javith_Ali — Fri, 11 Aug 2017 07:24:23 GMT

DNS configured in GP settings: Primary DNS 10.250.1.1, secondary DNS 10.250.1.2

Access route: split tunnel- 10.250.0.0/16 allowed in GP.

Once clients are connected to globalprotect, they are getting the above DNS settings. so the traffic going to internet also resolving in above Internal DNS server.

Now i have the requirement for GP users, when traffic going to internet, it should resolve using public DNS say 8.8.8.8 or 4.2.2.2

and the traffic going to 10.250.0.0/16 to GP tunnel should resolve to DNS 10.250.1.1, secondary DNS 10.250.1.2.

I have configured as per below KB for fulfil the above requirement. its working fine, some of the users complain about internal DNS server issue for GP connected internal sites sometimes. However internet traffic resolution working fine. so we have removed this config

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-DNS-Proxy-for-GlobalProtect-Clients/ta-p/124541

Kindly suggest if there is any workaround for this requirement

Re: DNS proxy to GP clients

reaper — Fri, 11 Aug 2017 08:29:15 GMT

Have you been able to troubleshoot the user's complaints? using the DNS proxy configuration should be the method to accomplish this requirement

how did you configure it exactly?

Re: DNS proxy to GP clients

Javith_Ali — Fri, 11 Aug 2017 16:12:35 GMT

Hi,

Thansk for reply

we dont have more time to troubleshoot this issue as lots of users are complaining about DNS resolution. Hence we revert back to old configurations which is resolving all queries in internal server.

From the users machine, we are getting the dns timed out in nslookup and in firewall queries are sent from dns proxy ip to external servers and less queries to internal servers. yet to collect the logs, Just posted here to check for alternative solution.

Re: DNS proxy to GP clients

reaper — Fri, 11 Aug 2017 18:27:25 GMT

Outside of the box, you could set up a bind server in dmz in caching mode, set your internal domains as forwarded to internal server, everything else as forwarded to internet dns