I'm trying to route to some internal domain controllers for domain local DNS, and public DNS servers for everything else. This seems reasonably straight-forward except that when I specify the internal network IPs of the Domain DNS servers, they timeout all requests for domain DNS when looking up via the Palo DNS proxy. All other DNS resolves via the Palo DNS proxy OK.
If I create a public IP for our domain DNS servers and point the DNS Proxy domain lookups to the public IP of those DNS servers, the Domain DNS resolves as does all other DNS..
From the console, the host is able to ping the internal IP of the DNS servers and the DNS servers do not have a firewall, so will talk to anyone.
The network segment in question (containing the DNS servers) is behind a VPN that is being managed by the Palo Alto as well.
I've also created a security/zone policy that says that any zones except the external fibre interface are allowed outbound access to the VPN zone for any service, however it still times out.
I'm unsure how to even replicate this timeout from the Palo Alto console as I can't determine which interface the DNS Proxy makes its requests from
This guide was followed: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHfCAK
hen you ping the dns server from the firewall, are you sourcing the ping from the interface the dnsproxy is attached to or without source (mgmt interface)
is it possible a nat rule is between the dnsproxy interface and the vpn tunnel, or a security policy above your allow all that's still interfering?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!