DNS traffic allowed for one server but dropped for another

Reply
Highlighted
L0 Member

DNS traffic allowed for one server but dropped for another

I have a perplexing problem with allowing DNS traffic from internal to the internet on our new PA-3020 running 7.0.3.

 

We have 2 DNS servers in our datacentre on the same subnet that perform queries to a couple of external DNS servers provided by our telco.

 

I have a rule allowing traffic from the 2 IP's (Internal Zone) for our DNS servers out to the internet (any) on UDP port 53

 

One server is successfully using this rule but the other server bypasses the rule and gets blocked by the explicit deny at the bottom. The traffic log shows the correct port (53) but the application is "not-applicable". I've tried the following "application/service" settings but there is no change to the issue:

 

Application: any            Service UDP 53

Application: dns            Service: application-default

Application: dns            Service UDP 53

 

I've done packet captures on the server that's not working and the destination port for the traffic is UDP 53 so I'm at a real loss to know why this is happening. Can anyone assist me here please?

 

Thanks!


Accepted Solutions
Highlighted
L4 Transporter

Hi,

 

If the application is not-applicable, it means the firewall didn't even bother trying to identify the application because no rule with the protocol/port matched the packet. Are you sure the blocked traffic is not TCP? DNS can be UDP or TCP, so you should just use application default in the case of DNS. Alternatively, add another service for TCP port 53.

 

Regards,

 

Benjamin

View solution in original post


All Replies
Highlighted
L4 Transporter

Hi,

 

If the application is not-applicable, it means the firewall didn't even bother trying to identify the application because no rule with the protocol/port matched the packet. Are you sure the blocked traffic is not TCP? DNS can be UDP or TCP, so you should just use application default in the case of DNS. Alternatively, add another service for TCP port 53.

 

Regards,

 

Benjamin

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!