DNS Rewrite and NAT Traffic and without NAT Traffic

[A.jauhar]

Hi,

We have scenario in which two different subnets in DMZ Zone communicating with Internal Zone but 

1. One subnet is allowed to communicate with Internal Subnets (Internal Zone) without NAT (Source or Destination).
2. 2nd subnet is allowed to communicate with Internal Subnets (Internal Zone) with NAT (Destination).

Our only DNS Server (10.10.20.1) is residing in Internal with DNS Entries (A Record) of Internal Servers e.g. web.xyz.com --> 10.10.10.1. Both Subnet are pointing to same DNS Server  (10.10.20.1). 

Both Subnets are allowed to communicate to Internal Server web.xyz.com by using hostname (FQDN). As traffic for 2nd Subnet involve NATting, that subnet is not able to communicate with Internal Server. Whereas First Subnet is able to communicate with it without any issue.

To solve this issue, we configure NAT Rule for 2nd Subnet with Specific Source, Specific NATted IP and Specific Original IP with DNS Rewrite Reverse Option. 

After above configuration, 2nd subnet able to communicate with Internal Server but first subnet facing issue. To troubleshoot the issue, once we resolve hostname on first subnet, it is resolving NATted IP which is configured for 2nd subnet. 

My question: Why Palo Alto doing rewrite for First Subnet as we didn't configure NAT Configuration. Also is there any other solution available to solve our scenario.