DNS Proxy Configuration with VPN

[Envisian]

Hi,

I'm trying to route to some internal domain controllers for domain local DNS, and public DNS servers for everything else. This seems reasonably straight-forward except that when I specify the internal network IPs of the Domain DNS servers, they timeout all requests for domain DNS when looking up via the Palo DNS proxy. All other DNS resolves via the Palo DNS proxy OK.

If I create a public IP for our domain DNS servers and point the DNS Proxy domain lookups to the public IP of those DNS servers, the Domain DNS resolves as does all other DNS..

From the console, the host is able to ping the internal IP of the DNS servers and the DNS servers do not have a firewall, so will talk to anyone.

The network segment in question (containing the DNS servers) is behind a VPN that is being managed by the Palo Alto as well.

I've also created a security/zone policy that says that any zones except the external fibre interface are allowed outbound access to the VPN zone for any service, however it still times out.

I'm unsure how to even replicate this timeout from the Palo Alto console as I can't determine which interface the DNS Proxy makes its requests from

This guide was followed: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHfCAK

[reaper]

hen you ping the dns server from the firewall, are you sourcing the ping from the interface the dnsproxy is attached to or without source (mgmt interface)

is it possible a nat rule is between the dnsproxy interface and the vpn tunnel, or a security policy above your allow all that's still interfering?