topic Re: FQDN refresh failed in General Topics

FQDN refresh failed

darrenclegg — Tue, 12 Mar 2019 11:58:47 GMT

We have 4 PaloAlto clusters and a FQDN refresh works on 3 of the clusters but not the 4th. All objects are shared on the 4 clusters. I have tried:

Scheduled refresh of FQDN fails

Manual refresh of FQDN fails

Changed the FQDN refresh time.

I can ping the DNS server from the Management Interface.

If i ping a DNS it resolves.

If I create a FQDN object it resolves.

but when I run request system fqdn show it states that no objects were resolved.

I have checked the logs (output below):

2019-03-12 11:46:25.988 +0000 dnscfgmod: FQDN Refresh: Periodic Force Refresh
2019-03-12 11:46:25.989 +0000 dnscfgmod: Main refresh function: (Force Refresh)
2019-03-12 11:46:25.989 +0000 dnscfgmod:Fqdn refresh job 496 scheduled
2019-03-12 11:46:25.989 +0000 FqdnRefresh job started processing. Dequeue time=2019/03/12 11:46:25
2019-03-12 11:46:30.863 +0000 dnscfgmod: Resolving fqdns took 5 secs
2019-03-12 11:46:30.863 +0000 Fqdn refresher thread device requested last config
2019-03-12 11:46:43.052 +0000 Error: pan_cfg_dnscfg_refresh_fqdns(pan_cfg_dnscfg.c:4340): Failed to refresh the fqdn.
2019-03-12 11:46:43.122 +0000 Error: pan_jobmgr_process_job(pan_job_mgr.c:2904): Fqdn Refresh job failed

Can anyone help?

Re: FQDN refresh failed

OtakarKlier — Tue, 12 Mar 2019 17:55:13 GMT

Hello,

Verify the service route to make sure that interface has access to the requested DNS servers. If you have not changed them the default is the management interface. Is there a PAN or security policy between the MGMT interface and the DNS servers? If yes, check the logs to see if/where it is getting blocked.

Hope that helps.

Re: FQDN refresh failed

darrenclegg — Wed, 20 Mar 2019 09:00:24 GMT

I checked all the settings again and they are set exactly the same for all 4 clusters we have. On Monday morning the FQDN refresh job worked successfully and has continued to work since. I do not know why it was not working or how it was fixed as no changes were made. hay-ho I am happy it is working for now.