DNS Response Address Translation

[debsPal0]

Can the PA's perform an address translation (assuming an appropriate NAT rule is configured) for an IP address that's presented as an answer in a DNS response message? I.E as highlighted in red below.

I have tested it and it doesn't work, if the functionality doesn't currently exist is it on any road-map to be added?

====================================================

Domain Name System (response)

    [Request In: 74]

    [Time: 0.000245000 seconds]

    Transaction ID: 0x5d79

    Flags: 0x8580 Standard query response, No error

    Questions: 1

    Answer RRs: 2

    Authority RRs: 6

    Additional RRs: 6

    Queries

    Answers

        test.test.com: type A, class IN, addr 1.1.1.1

            Name: test.test.com

            Type: A (Host address)

            Class: IN (0x0001)

            Time to live: 1 hour

            Data length: 4

            Addr: 1.1.1.1 (1.1.1.1)

=============================================

Regards,

James.

[HULK]

Hi James,

Please let me know what type of NAT you have configured for DNS traffic. Can you try once with static NAT for the same and let me know the result.

Note- make sure app-override is not configured for DNS traffic.

Thanks

[hyadavalli]

Hello James,

If you are using dns proxy object then there is a tab for static entries under dns proxy object where you can specify natted address.

Regards,

Hari Yadavalli

[mbutt]

Below are good documents which explains How Management Interface Use DNS Proxy Rules And Static Entries Through DNS Proxy Object.

https://live.paloaltonetworks.com/docs/DOC-4604

https://live.paloaltonetworks.com/docs/DOC-4633

Here some more related documents

https://live.paloaltonetworks.com/docs/DOC-3522

https://live.paloaltonetworks.com/docs/DOC-3637

https://live.paloaltonetworks.com/docs/DOC-4593

Hope this helps.
Thanks

Numan