Can't browse web pages

[wzahri]

Hello all, 

I'm new in Paloalto firewalls, i'm doing a migration from Fortigate to PA220. i configured all interfaces, router... but I'm struggling with Policies

attached the basic policy i created to allow my LAN users to access internet:

After testing the PA:

• users can only ping to internet eg: 8.8.8.8
• users can access website using IP address not with the URL

PS: we have an internal DNS, Activedirectory, but in the PA220 i configured the DNS using 8.8.8.8 "Attached config"

PS: NAT configured "Attached config"

can you please advice if i'm missing something.

Thank you in advance

[reaper]

the 8.8.8.8 you show in the screenshot is only used by the management interface of the firewall itself. you do have a security policy that would allow dns coming from your network to go out to the internet

did you add dns servers to your dhcp options so clients are issued with dns servers (your AD)? (and if the AD is being assigned, did you verify the AD has access to the internet?)

[wzahri]

Thank you @reaper for your reply

I didn't configure a policy that would allow dns coming from DMZ" AD+DNS" to ==> Internet, i will configure it.

for your second point: the active directory is acting also as an DHCP so i configured a DHCP relay in the PaloAlto.

i have to verify if the AD have access to internet also.

the policies to go out to internet are correct or maybe i have to change something ?

[reaper]

Ah ha @wzahri ! With 3 interfaces things get a little more complex 🙂

You'll want the dhcp relay on the LAN interface pointing to the AD

Rules

From lan to dmz "all AD services (dns, smb, netbios, ....)" Allow

From dmz to untrust dns/ntp/ms-updates allow

From lan to untrust "web apps" allow

From lan+dmz to untrust block log

From lan+dmz interzone block log

[wzahri]

Great thanks for your reply.

I will configure those policies, perform a test and back to you tomorrow.

Thanks again.

[wzahri]

hi@reaper 

Unfortunately the same issue 😞 

i tried to open all services  on Any Any to test 

Rules

From lan to dmz "all AD services (dns, smb, netbios, ....)" ==> Allow Any Any

From dmz to untrust dns/ntp/ms-updates allow==> Any Any

From lan to untrust "web apps" allow==> Any Any

do i have to configure something in "service routing" ? 

[reaper · Accepted solution]

the service route is only used by the management interface of the firewall, it is used when the physical mgmt interface is located in an oob network that has no internet access

if you have  any any open in all directions and you can only reach IP addresses, there must be something wrong with how DNS is resolved

can you check which DNS server is on your clients

what if you replace that with 1.1.1.1

in case your clients do dns lookups on your AD, can you see those connections in the firewall sessions and is there packets sent AND received ?

set up wireshark on client and AD to see if both see all packets

then, do the same with AD and it's upstream DNS: do you see dns queries leave and come back? what if you set the upstream ('Forwarders') to 1.1.1.1

[wzahri]

Thanks @reaper  i will keep testing and TS, as you mentioned it's a DNS issue.

I will back to you

[wzahri]

Hi @reaper 

Yes it was a DNS Issue. i changed the DNS config in the AD. it's works fine now.

Thank you for your help.