topic FQDN cache limitations in General Topics

FQDN cache limitations

hshawn — Thu, 10 Jan 2019 18:57:26 GMT

I wanted to reach out tot he community and see how people are handling FQDN cache limit issues.

Example:

* Internal DNS caches up to 8 IPs for each FQDN

* PAN device will cache up to 10 (source: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHJCA0)

If you have a security policy that allows traffic to blah.domain.com and that FQDN is in AWS and could be 20/30/100 IPs your traffic will not always hit the policy allowing the traffic you want to allow since the IP address the application happens to hit will not always be in the FQDN cache.

possible solution #1: have the vendor add more FQDNs (good luck)

possible solution #2: manually add a ton of IPs to the security policy (horrible idea)

possible solution #3: leave it alone and accept that the application will try again and eventually hit an IP that is cached

possible solution #4: Ask the vendor to use a load balancer (good luck)

possible solution #5: ?

Anyone else run into this? I know there has to be a limit somewhere but I can see this being more and more of an issue as things are moved into the cloud.

Re: FQDN cache limitations

BPry — Thu, 10 Jan 2019 20:30:55 GMT

@hshawn

Solution #6: Script it.

Through the API you could use a script to gather the 100 IPs a domain could be tied to, and then you could create address objects for each address and create an address-group that consists of the recorded IPs. Whenever that script runs you simply take the last recorded results and remove them, rebuild the list via the current pulled results, and then schedule a commit so that you keep the address-group clean of unused addresses.

Re: FQDN cache limitations

Remo — Thu, 10 Jan 2019 20:44:48 GMT

Solution 6.1# Script it and use dynamic address groups. This way you don't need to commit changes as they will be active immediately: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-panorama-api/pan-os-xml-api-request-types/apply-user-id-mapping-and-populate-dynamic-address-groups-api