DNS traffic allowed for one server but dropped for another

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

DNS traffic allowed for one server but dropped for another

L0 Member

I have a perplexing problem with allowing DNS traffic from internal to the internet on our new PA-3020 running 7.0.3.

 

We have 2 DNS servers in our datacentre on the same subnet that perform queries to a couple of external DNS servers provided by our telco.

 

I have a rule allowing traffic from the 2 IP's (Internal Zone) for our DNS servers out to the internet (any) on UDP port 53

 

One server is successfully using this rule but the other server bypasses the rule and gets blocked by the explicit deny at the bottom. The traffic log shows the correct port (53) but the application is "not-applicable". I've tried the following "application/service" settings but there is no change to the issue:

 

Application: any            Service UDP 53

Application: dns            Service: application-default

Application: dns            Service UDP 53

 

I've done packet captures on the server that's not working and the destination port for the traffic is UDP 53 so I'm at a real loss to know why this is happening. Can anyone assist me here please?

 

Thanks!

1 accepted solution

Accepted Solutions

L4 Transporter

Hi,

 

If the application is not-applicable, it means the firewall didn't even bother trying to identify the application because no rule with the protocol/port matched the packet. Are you sure the blocked traffic is not TCP? DNS can be UDP or TCP, so you should just use application default in the case of DNS. Alternatively, add another service for TCP port 53.

 

Regards,

 

Benjamin

View solution in original post

1 REPLY 1

L4 Transporter

Hi,

 

If the application is not-applicable, it means the firewall didn't even bother trying to identify the application because no rule with the protocol/port matched the packet. Are you sure the blocked traffic is not TCP? DNS can be UDP or TCP, so you should just use application default in the case of DNS. Alternatively, add another service for TCP port 53.

 

Regards,

 

Benjamin

  • 1 accepted solution
  • 3957 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!