topic DNS queries to resolve internal hosts from PA managment IP in General Topics

DNS queries to resolve internal hosts from PA managment IP

Abdul_Razaq — Wed, 10 Jun 2020 07:50:45 GMT

Hi Community,

I can see my firewall is sending DNS requests ( request for A record) to resolve some of internal hostnames.

I dont have GP/detect internal host configured
I dont have FQDN objects with these hostnames
I have exported and checked entire config, the firewall is not having this hostname in the configuration
It is requesting for A record ( so 'resolve hostname' is not causing it.
Dont have DNS proxy configured in firewall
This are internal hostnames, not malicious, which rule out DNS queries because of HTTP/TLS evasion

This looks like firewall is trying to resolve in real time. I understands that firewall will be using DNS for reporting, management services (such as email, Kerberos, SNMP, syslog) as per document. But not sure because of which of this reason firewall is trying to resolve these internal hostnames. It would be helpful if anybody can answer this.

Thanks in advance !

Re: DNS queries to resolve internal hosts from PA managment IP

BPry — Wed, 10 Jun 2020 14:28:23 GMT

@Abdul_Razaq,

Do you have WMI probing enabled within User Identification?

Re: DNS queries to resolve internal hosts from PA managment IP

Abdul_Razaq — Wed, 10 Jun 2020 14:38:15 GMT

Hi @BPry ,

Thanks for your input.

I thought of this possibility as WMI probing is enabled, but as the user IP mapping entries will be IP address, i don't see a need for PA to do a DNS query for device hostnames other than the hostname of AD servers.

I am wondering if there is any two way of verification to find the hostname of an IP, then a DNS query for A record for verifying it.

Thanks in advance.

Re: DNS queries to resolve internal hosts from PA managment IP

Abdul_Razaq — Wed, 01 Jul 2020 06:01:15 GMT

Hi All,

Anybody have any though on this.. i can see the DNS query for only couple of servers (it should not be for WMI i feel as i can see it only for very less endpoints directly connected to firewall). I am even confused how firewall got this hostname in first place.

Thanks in advance.