topic Re: DNS Proxy listen to broadcast? in General Topics

DNS Proxy listen to broadcast?

ChrisCon — Thu, 25 Mar 2021 06:15:05 GMT

Hello!
I have a cisco wlan accesspoint (at remote site), which lost connection to central wlan-controller. Due to a mistake this ap still has static ip-address, so it does not send DHCP-discover/requests when it is started. But it sends DNS-requests searching for "cisco-capwap-controller". So I thought it might help to configure a DNS-proxy on the Palo Alto with static DNS entry "cisco-capwap-controller". Unfortunately the cisco ap sends its DNS-requests to broadcast-address 255.255.255.255. And this is dropped, even when firewall-rule with destination any (allowed) is used.
Is there a change to force Palo Alto to reply to the DNS-requests?
Thanks.

Re: DNS Proxy listen to broadcast?

nikoolayy1 — Thu, 25 Mar 2021 07:13:40 GMT

You may test with static arp entries like the examples below but they use network directed broadcast and not 255.255.255.255 so just test if it will work as I haven't done this myself with 255.255.255.255:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boLYCAY&lang=en_US%E2%80%A9

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clq3CAC

The Cisco Access points also use DHCP and the option 43 for controller discovery, so maybe it is better to set the Palo Alto as the DHCP server or DHCP Relay (it is supported) than using DNS.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/dhcp/dhcp-options/dhcp-options-43-55-and-60-and-other-customized-options.html

Re: DNS Proxy listen to broadcast?

BPry — Thu, 25 Mar 2021 14:20:55 GMT

@ChrisCon,

I would recommend just setting up DHCP option 43 for the access points on these remote offices like @nikoolayy1 already mentioned. That's the actual process Cisco is expecting you to use in these type of scenarios.

Re: DNS Proxy listen to broadcast?

nikoolayy1 — Fri, 26 Mar 2021 19:53:53 GMT

Please test and tell us the results and mark the Discussion as closed if you managed to resolve it.

Re: DNS Proxy listen to broadcast?

ChrisCon — Mon, 29 Mar 2021 16:29:27 GMT

Thanks for reply, but it did not help in my case.
But static arp was a good hint for future.

Re: DNS Proxy listen to broadcast?

ChrisCon — Mon, 29 Mar 2021 16:32:55 GMT

Yes of course option 43 is the best way.

But unfortunately the accesspoint was reset with "clear config except static ip". So it kept static ip address and does not send DHCP-discover/request now.

Re: DNS Proxy listen to broadcast?

nikoolayy1 — Tue, 30 Mar 2021 14:14:11 GMT

Except if the static arp does not help to use a vWire if possible I think maybe somone must go and again clear the config but this time without "except static ip". Share how you solved this problem after this, if possible.

Re: DNS Proxy listen to broadcast?

ChrisCon — Fri, 02 Apr 2021 11:57:06 GMT

Another problem was, that the AP could not be located at the remote site.
But I could solve it with a nice little tool "AbateDNS". This replies to DNS-requests with a configured ip address. It even replies to broadcast-DNS. I only had to move a pc into the AP-VLAN. Then started the tool. The DNS-request-broadcast from Cisco-AP asking for "CISCO-CAPWAP-CONTROLLER" was seen and it replied with the configured ip address (WLC ip address).
Then AP knew the WLC and joined it.