- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
11-24-2015 06:36 PM
I have a perplexing problem with allowing DNS traffic from internal to the internet on our new PA-3020 running 7.0.3.
We have 2 DNS servers in our datacentre on the same subnet that perform queries to a couple of external DNS servers provided by our telco.
I have a rule allowing traffic from the 2 IP's (Internal Zone) for our DNS servers out to the internet (any) on UDP port 53
One server is successfully using this rule but the other server bypasses the rule and gets blocked by the explicit deny at the bottom. The traffic log shows the correct port (53) but the application is "not-applicable". I've tried the following "application/service" settings but there is no change to the issue:
Application: any Service UDP 53
Application: dns Service: application-default
Application: dns Service UDP 53
I've done packet captures on the server that's not working and the destination port for the traffic is UDP 53 so I'm at a real loss to know why this is happening. Can anyone assist me here please?
Thanks!
11-24-2015 09:12 PM
Hi,
If the application is not-applicable, it means the firewall didn't even bother trying to identify the application because no rule with the protocol/port matched the packet. Are you sure the blocked traffic is not TCP? DNS can be UDP or TCP, so you should just use application default in the case of DNS. Alternatively, add another service for TCP port 53.
Regards,
Benjamin
11-24-2015 09:12 PM
Hi,
If the application is not-applicable, it means the firewall didn't even bother trying to identify the application because no rule with the protocol/port matched the packet. Are you sure the blocked traffic is not TCP? DNS can be UDP or TCP, so you should just use application default in the case of DNS. Alternatively, add another service for TCP port 53.
Regards,
Benjamin
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!