dns proxy - static entries

[FlexyZ]

Hi

I have a dns proxy on one of my interfaces with some static entries, but nothing is resolved on the static ones - they should have a higher priority than the primary dns IP right?

Thanks

[gswcowboy]

Provide output from the following commands:

> show dns-proxy cache all
> show dns-proxy settings all
> show dns-proxy static-entries all
> show dns-proxy statistics all

[FlexyZ]

hmm my issues seems to be related to windows  - I have no DNS suffix in my DNS client configuration

PA-500:

DNS proxy -> d1 -> test -> 10.10.10.10

DNS proxy -> d2 -> test.test -> 20.20.20.20

Windows 7 and Windows Serer 2008 ->

ping test.test -> 20.20.20.20

ping test -> nothing resolved

ping test. -> 10.10.10.10

ping test -> 10.10.10.10

This is kind of weird I think - my goal is to specify static hosts that all clients should resolve - Any clues are very welcome!

Thanks

[sspringer]

It is possible windows is modifying the DNS request by adding its own suffix. Please gather PCAPs from the Windows machine to verify the DNS query.

Also you have made a post that some static DNS proxy entries are not working (https://live.paloaltonetworks.com/thread/3778) - When you were performing these tests did you verify the static entries were present on the PAN?

Regards,

Stefan

[FlexyZ]

disable/enable showed the static entries again from the CLI, but then the DNS-Proxy in general didnt work.

I tried to from eth(s), commit and added them again, commit - but no luck

So I had to reboot firewall - and when it came up still no go - until I noticed it was not enabled (even though I did it before reboot)

Enable fixed it - I have opened a support case, but is going though a partner, so not very responsive.

Thanks

[FlexyZ]

sorry wrong case

should be https://live.paloaltonetworks.com/message/10956#10956

This is been resolve by added static entries with 2 levels xxxx.yyy.com etc. and adding yyy.com suffix in DHCP scope