DNS traffic allowed for one server but dropped for another

[Mitre10]

I have a perplexing problem with allowing DNS traffic from internal to the internet on our new PA-3020 running 7.0.3.

We have 2 DNS servers in our datacentre on the same subnet that perform queries to a couple of external DNS servers provided by our telco.

I have a rule allowing traffic from the 2 IP's (Internal Zone) for our DNS servers out to the internet (any) on UDP port 53

One server is successfully using this rule but the other server bypasses the rule and gets blocked by the explicit deny at the bottom. The traffic log shows the correct port (53) but the application is "not-applicable". I've tried the following "application/service" settings but there is no change to the issue:

Application: any            Service UDP 53

Application: dns            Service: application-default

Application: dns            Service UDP 53

I've done packet captures on the server that's not working and the destination port for the traffic is UDP 53 so I'm at a real loss to know why this is happening. Can anyone assist me here please?

Thanks!

[BenjAudy.MTL · Accepted solution]

Hi,

If the application is not-applicable, it means the firewall didn't even bother trying to identify the application because no rule with the protocol/port matched the packet. Are you sure the blocked traffic is not TCP? DNS can be UDP or TCP, so you should just use application default in the case of DNS. Alternatively, add another service for TCP port 53.

Regards,

Benjamin