topic Re: DNS Response Address Translation in General Topics

DNS Response Address Translation

debsPal0 — Wed, 04 Sep 2013 08:00:41 GMT

Can the PA's perform an address translation (assuming an appropriate NAT rule is configured) for an IP address that's presented as an answer in a DNS response message? I.E as highlighted in red below.

I have tested it and it doesn't work, if the functionality doesn't currently exist is it on any road-map to be added?

====================================================

Domain Name System (response)

[Request In: 74]

[Time: 0.000245000 seconds]

Transaction ID: 0x5d79

Flags: 0x8580 Standard query response, No error

Questions: 1

Answer RRs: 2

Authority RRs: 6

Additional RRs: 6

Queries

Answers

test.test.com: type A, class IN, addr 1.1.1.1

Name: test.test.com

Type: A (Host address)

Class: IN (0x0001)

Time to live: 1 hour

Data length: 4

Addr: 1.1.1.1 (1.1.1.1)

=============================================

Regards,

James.

Re: DNS Response Address Translation

HULK — Wed, 04 Sep 2013 08:24:40 GMT

Hi James,

Please let me know what type of NAT you have configured for DNS traffic. Can you try once with static NAT for the same and let me know the result.

Note- make sure app-override is not configured for DNS traffic.

Thanks

Re: DNS Response Address Translation

hyadavalli — Wed, 04 Sep 2013 16:04:26 GMT

Hello James,

If you are using dns proxy object then there is a tab for static entries under dns proxy object where you can specify natted address.

Regards,

Hari Yadavalli

Re: DNS Response Address Translation

mbutt — Wed, 04 Sep 2013 17:28:51 GMT

Below are good documents which explains How Management Interface Use DNS Proxy Rules And Static Entries Through DNS Proxy Object.

https://live.paloaltonetworks.com/docs/DOC-4604

https://live.paloaltonetworks.com/docs/DOC-4633

Here some more related documents

https://live.paloaltonetworks.com/docs/DOC-3522

https://live.paloaltonetworks.com/docs/DOC-3637

https://live.paloaltonetworks.com/docs/DOC-4593

Hope this helps.
Thanks

Numan