FQDN Address Objects Not Resolving - PANOS 6

[SDorsey]

I have a few different clients with the same issue.

I have some FQDN address objects and I assign a TAG to each of those objects. Then I create a Dynamic address object group which contains address objects with that tag. Then I add the dynamic group to a policy.

Traffic is not matching on that policy; it is matching on explicit deny rule.

If I run "request system fqdn show", I get:

sharepoint.domain.org  (Objectname SharePoint):

                        Not used

From the PAN, I can surely resolve the specific names. It just isn't storing them in the object db it appears. If I change the address object group to a static group and add the address objects manually as opposed to tagging/dynamic, it works fine.

[Wenar · Accepted solution]

If you are on PanOS 6 it's a known issue. I have already a case open for this. It will be fixed in 6.1 (not 6.0.X at the moment)

Edit: Bug ID is 64223

[HULK]

The above mentioned symptoms is looks like Bug - "FQDN objects in Dynamic address group show up as not used when doing 'request system fqdn show".

Few related discussion on the same topic:

not resolved

Unresolved FQDNs in Security Policy Result in Shadow Policy Warning During Commit

FQDN Table in CLI

Hope this helps.

Thanks

[SDorsey]

Thanks! Do you have any idea when 6.1 may drop? I thought it was the end of this year and that seems like a bit to wait for this bug fix.

[HULK]

You may ask to your Palo Alto SE for the same. Also, you may convey your requirement to get it fixed in 6.0.x release ( if possible).

Thanks

[Wenar]

I'm still waiting for a response if it will be fixed in an earlier release. I will post it here if I get an answer.

[pulukas]

Wenar Thanks for the bug id and the follow up.

[Wenar]

I got the information that this bug will be fixed in version 6.0.7