topic DNS proxy sharepoint domain issue when cache enabled in General Topics

DNS proxy sharepoint domain issue when cache enabled

Chris.Ka — Sun, 08 Nov 2020 07:20:01 GMT

Hi there, i have some issues with my firewall when using dns-proxy with enabled cache. I cannot resolve sharepoint domains e.g. bitmix.sharepoint.com, but when I disable the cacheoption everything works fine.
Does someone have any suggestion how I could solve this?
I'm using PanOS 10.0.2

Re: DNS proxy sharepoint domain issue when cache enabled

BPry — Sun, 08 Nov 2020 18:41:17 GMT

@Chris.Ka,

Open a TAC case and ask them to replicate the issue. Sounds you you've possibly found a PAN-OS 10 bug.

FYI,

Unless you need to run PAN-OS 10 due a feature set, I wouldn't recommend running it yet on production gear. I'd stick with PAN-OS 9.1 for anything production related.

Re: DNS proxy sharepoint domain issue when cache enabled

kevin_thys — Mon, 23 Nov 2020 13:04:20 GMT

I do notice the same issue. Did they found the root cause? If not I would also open a ticket to help them finding the roort cause.

Re: DNS proxy sharepoint domain issue when cache enabled

jmretting — Sun, 24 Jan 2021 10:57:53 GMT

Also "dns cache" should be applied at the "proxy rule" level, not the parent layer.

Re: DNS proxy sharepoint domain issue when cache enabled

TerryStevens — Thu, 04 Feb 2021 08:12:53 GMT

@Chris.Ka wrote:
Hi there, i have some issues with my firewall when using dns-proxy with enabled cache. I cannot resolve sharepoint domains e.g. bitmix.sharepoint.com, but when I disable the cacheoption everything works fine.
Does someone have any suggestion how I could solve this? mybizaccount
I'm using PanOS 10.0.2

I think I am also facing this issue. but Thanks for the information.

Re: DNS proxy sharepoint domain issue when cache enabled

DavidRees_Imdex — Mon, 08 Mar 2021 03:44:54 GMT

Same issue found on 10.0.4

Re: DNS proxy sharepoint domain issue when cache enabled

morgnercoit — Mon, 08 Mar 2021 04:24:40 GMT

I have found that PA management DNS fails if Cache is disabled on the DNS Proxy. I needed to break out DNS management interface from a bug fixed DNS proxy with cache disabled. And then enable cache and replicate any dns/static rules. I have identified *.intuit.com and *.sharepoint.com. Applying non-cache enabled rules for those domains in your DNS proxy will fix failing lookups. However I don't know if there is any reasonable way to determine what FQDN's are affects. In which case....DNS Proxy cache should not be used on version 10 in any production environment. Needing to enable cache on the managment interface for DNS also means there is no way to apply firewall policies regarding those afflicted unknown/known FQDNs. v10 is not production ready. 😞

Re: DNS proxy sharepoint domain issue when cache enabled

Chris.Ka — Mon, 08 Mar 2021 07:18:09 GMT

I have created an support case for this issue and its a known issue. Here is the important part from the support response:

Root cause:-

When dnsproxy cache is enabled, we always prepare the response from the cache (regardless if we have the records in cache already or we need to forward the request to a name sever first)
During this process, dnsproxy does not check if the prepared DNS response is too big or not (default udp limit should be 512 bytes). So the DNS response prepared by dnsproxy could be dropped by other PAN FWs or network devices if the size is larger than the limit (512 or otherwise specified in EDNS)

This problem usually happens with nested CNAME records and when cache is used due to dnsproxy's limited compression ability.

As a workaround, one can
1. disable cache
2. add DNS proxy rule for this FQDN and not use cache
3. use EDNS (it allows larger UDP DNS)

Re: DNS proxy sharepoint domain issue when cache enabled

morgnercoit — Mon, 08 Mar 2021 07:29:17 GMT

I have found that if you have a tunnel interface assigned as DNS Service route, and you turn DNS Proxy cache off, resolution fails for all FQDNs.

Re: DNS proxy sharepoint domain issue when cache enabled

jmretting — Fri, 26 Mar 2021 05:42:32 GMT

Looks like its fixed in 10.0.5. Looks like a combination of multiple, from what it looks like, DNS proxy fixes according according release notes.