DNS proxy setup

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

DNS proxy setup

L1 Bithead

Hi,  I have a firewall rule on my Palo Alto to NAT a public IP to a private IP on the DMZ.  The external users who don’t work for my company can hit the public IP by DNS name, get onto the website, and view the content etc.  This is all working fine. A few times per year I must take the internal DMZ server offline for patching and it could be off for a few hours.  Is it possible for me to re-direct the external users still trying to access the DNS name over to an external website while the server is unreachable.  I have got a webpage built in Azure to say the server is down for maintenance and can they try later.  I was wondering could I do this via DNS proxy or would I be better trying to do this with an external Load balancer.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/network/network-dns-proxy/dns...

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

In the DNS proxy you can change or redirect DNS records, but I would not be inclined to expose this to the internet.

 

You could simply change the DNS A record temporarily to point to a landing page while you work on the server, and then switch the A record back to the correct IP after you're done

 

if you currently have a TTL of 24 hours, you could change it to 5 minutes the day before the maintenance. 15 minutes before you can update the A record, and then after you're done change the record and set the TTL back to 24 hours. 

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

View solution in original post

3 REPLIES 3

Cyber Elite
Cyber Elite

In the DNS proxy you can change or redirect DNS records, but I would not be inclined to expose this to the internet.

 

You could simply change the DNS A record temporarily to point to a landing page while you work on the server, and then switch the A record back to the correct IP after you're done

 

if you currently have a TTL of 24 hours, you could change it to 5 minutes the day before the maintenance. 15 minutes before you can update the A record, and then after you're done change the record and set the TTL back to 24 hours. 

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

L1 Bithead

Thanks for the advice - I'll give that a go

Thanks for answering, you made my day.

  • 1 accepted solution
  • 503 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!