Can't browse web pages

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Can't browse web pages

L1 Bithead

Hello all, 

I'm new in Paloalto firewalls, i'm doing a migration from Fortigate to PA220. i configured all interfaces, router... but I'm struggling with Policies

attached the basic policy i created to allow my LAN users to access internet:

After testing the PA:

  • users can only ping to internet eg:
  • users can access website using IP address not with the URL

PS: we have an internal DNS, Activedirectory, but in the PA220 i configured the DNS using "Attached config"

PS: NAT configured "Attached config"

can you please advice if i'm missing something.


Thank you in advance

dns config.PNGNAT config.PNGpolicy.PNG


Accepted Solutions

the service route is only used by the management interface of the firewall, it is used when the physical mgmt interface is located in an oob network that has no internet access


if you have  any any open in all directions and you can only reach IP addresses, there must be something wrong with how DNS is resolved


can you check which DNS server is on your clients

what if you replace that with


in case your clients do dns lookups on your AD, can you see those connections in the firewall sessions and is there packets sent AND received ?

set up wireshark on client and AD to see if both see all packets


then, do the same with AD and it's upstream DNS: do you see dns queries leave and come back? what if you set the upstream ('Forwarders') to

Tom Piens
PANgurus - (co)managed services and consultancy

View solution in original post


Cyber Elite
Cyber Elite

the you show in the screenshot is only used by the management interface of the firewall itself. you do have a security policy that would allow dns coming from your network to go out to the internet

did you add dns servers to your dhcp options so clients are issued with dns servers (your AD)? (and if the AD is being assigned, did you verify the AD has access to the internet?)







Tom Piens
PANgurus - (co)managed services and consultancy

Thank you @reaper for your reply


I didn't configure a policy that would allow dns coming from DMZ" AD+DNS" to ==> Internet, i will configure it.


for your second point: the active directory is acting also as an DHCP so i configured a DHCP relay in the PaloAlto.

i have to verify if the AD have access to internet also.


the policies to go out to internet are correct or maybe i have to change something ?


dhcp rely.PNG

Ah ha @wzahri ! With 3 interfaces things get a little more complex 🙂


You'll want the dhcp relay on the LAN interface pointing to the AD



From lan to dmz "all AD services (dns, smb, netbios, ....)" Allow

From dmz to untrust dns/ntp/ms-updates allow

From lan to untrust "web apps" allow

From lan+dmz to untrust block log

From lan+dmz interzone block log


Tom Piens
PANgurus - (co)managed services and consultancy

Great thanks for your reply.

I will configure those policies, perform a test and back to you tomorrow.

Thanks again.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!