I have a cisco wlan accesspoint (at remote site), which lost connection to central wlan-controller. Due to a mistake this ap still has static ip-address, so it does not send DHCP-discover/requests when it is started. But it sends DNS-requests searching for "cisco-capwap-controller". So I thought it might help to configure a DNS-proxy on the Palo Alto with static DNS entry "cisco-capwap-controller". Unfortunately the cisco ap sends its DNS-requests to broadcast-address 255.255.255.255. And this is dropped, even when firewall-rule with destination any (allowed) is used.
Is there a change to force Palo Alto to reply to the DNS-requests?
Another problem was, that the AP could not be located at the remote site.
But I could solve it with a nice little tool "AbateDNS". This replies to DNS-requests with a configured ip address. It even replies to broadcast-DNS. I only had to move a pc into the AP-VLAN. Then started the tool. The DNS-request-broadcast from Cisco-AP asking for "CISCO-CAPWAP-CONTROLLER" was seen and it replied with the configured ip address (WLC ip address).
Then AP knew the WLC and joined it.
You may test with static arp entries like the examples below but they use network directed broadcast and not 255.255.255.255 so just test if it will work as I haven't done this myself with 255.255.255.255:
The Cisco Access points also use DHCP and the option 43 for controller discovery, so maybe it is better to set the Palo Alto as the DHCP server or DHCP Relay (it is supported) than using DNS.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!