topic Re: FQDN TTL shorter than refresh time in General Topics

FQDN TTL shorter than refresh time

MortensenKnud — Wed, 28 Nov 2018 14:55:06 GMT

I have a problem with some sites that uses DNS round robin as loadballancer.

As an examble:

vs-ssh.visualstudio.com

This has the TTL set to 300 sec, the PA's FQDN refresh is default 30 min.

So the firewall won't cache all IP's used in the round robin, because when it does a refresh the old value has timed-out

So the rule where I use the FQDN object fails periodic.

Is there a way to ignore the TTL value, not generally, but for indivually entries in the FQGN cache?

Rgds Knud

Re: FQDN TTL shorter than refresh time

Raido_Rattameister — Wed, 28 Nov 2018 15:19:44 GMT

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKbCAK

Re: FQDN TTL shorter than refresh time

MortensenKnud — Thu, 29 Nov 2018 07:20:14 GMT

That was not exactly what I was asking for, I know you can change the refresh time, but that wont solve the problem.

I need to be able to configure an alternative TTL per FQDN so instead of having a 5 min TTL I could configure the PA to ignore the TTL in the DNS reply and configure the cache to 24 hours, but only for that entry.

Re: FQDN TTL shorter than refresh time

Raido_Rattameister — Thu, 29 Nov 2018 14:26:35 GMT

Either DNS Proxy static entries or some external cron job to resolve names to IPs and then push results to Palo through API as often as needed.