FQDN cache limitations

L4 Transporter

FQDN cache limitations

I wanted to reach out tot he community and see how people are handling FQDN cache limit issues. 



* Internal DNS caches up to 8 IPs for each FQDN

* PAN device will cache up to 10 (source: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHJCA0)


If you have a security policy that allows traffic to blah.domain.com and that FQDN is in AWS and could be 20/30/100 IPs your traffic will not always hit the policy allowing the traffic you want to allow since the IP address the application happens to hit will not always be in the FQDN cache.


possible solution #1: have the vendor add more FQDNs (good luck)

possible solution #2: manually add a ton of IPs to the security policy (horrible idea)

possible solution #3: leave it alone and accept that the application will try again and eventually hit an IP that is cached

possible solution #4: Ask the vendor to use a load balancer (good luck)

possible solution #5: ?


Anyone else run into this? I know there has to be a limit somewhere but I can see this being more and more of an issue as things are moved into the cloud.

L7 Applicator

Re: FQDN cache limitations


Solution #6: Script it. 

Through the API you could use a script to gather the 100 IPs a domain could be tied to, and then you could create address objects for each address and create an address-group that consists of the recorded IPs. Whenever that script runs you simply take the last recorded results and remove them, rebuild the list via the current pulled results, and then schedule a commit so that you keep the address-group clean of unused addresses. 

L7 Applicator

Re: FQDN cache limitations

Solution 6.1# Script it and use dynamic address groups. This way you don't need to commit changes as they will be active immediately: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-panorama-api/pan-os-xml-api-request-types/apply-...

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!