Firewalls is not resolving domain names in address groups

[LimaSupport]

For some odd reason the firewall is not resolving external fqdn's that are part of an Address groups..

[Arnesh]

Hi @LimaSupport 

Can you describe how do you confirm the firewall is unable to resolve the domains? Have you checked it from the GUI or CLI of firewall? 

Mostly, the reason for the firewall not able to resolve the FQDNs is due to the firewall unable to reach the DNS server.

By default, mgmt interface is used to connect to the DNS server (but can be changed from Device > Setup > Services > Service Route Configuration)

You can check if the DNS server is reachable. The CLI command below can then be used to view the list of FQDN objects and the IP addresses associated with that name.

• PAN-OS 8.1 and below: > request system fqdn show
• PAN-OS 9.1 and above: > show dns-proxy fqdn all

Alternatively, you can also check the FQDN resolution on the GUI by navigating to Address Objects > Select the FQDN Address Object in question > Click on 'resolve'.

Please go through the below KBs, which can be of help:

How to Configure and Test FQDN Objects
DNSPROXY and FQDN address refresh behaviours - PANOS 9.0 and Above

Regards,

[Arnesh]

Have you also tried/checked if the DNS server (also configured on firewall) is able to resolve the external domains?

Regards,