FQDN as source address

[aaobuhov]

Hi to all

I have a problems with riles with FQDN

For example i created rule:

source ip - destination ip - destination port

I changed ip to FQDN object - pc1.domain.com.  Palo Alto can resolve name to IP. 

New Rule:

source FGDN - destination ip - destination port.

In first five minutes (more or less) rule works fine, but after that traffic not hitting this rule

Sometimes i see hit in traffic log, but most times traffic pass this rule and hit default rule.

FQDN record is present, but sometimes TTL is negative. FQDN refresh time is 1800 sec (default)

request system fqdn show
FQDN Table : Last Request time Fri Nov 9 11:30:36 2018
--------------------------------------------------------------------------------
IP Address Remaining TTL Secs Since Refreshed

pc1.domain.com (Objectname pc1.domain.com):

192.168.100.5 968 232

pc1.domain.com (Objectname pc1.domain.com):

192.168.100.5 -305 1505
pc1.domain.com (Objectname pc1.domain.com):

192.168.100.5 -514 1714

request system fqdn show

Server error : A refresh is in progress. Please try again later.

pc1.domain.com (Objectname pc1.domain.com):

192.168.100.5 1099 101

What is wrong?

[BPry]

@aaobuhov,

I would assume that the TTL set on your local DNS server is less than the default FQDN refresh time, and that you might have to decrease this to less than your set TTL on the DNS server. 

[aaobuhov]

Thanks for the answer. Can you tell me how to check TTL on the DNS server so that I can compare it with PA FQDN refresh time?

[BPry]

@aaobuhov,

Assuming Microsoft Servers are being used to supply DNS. 

Open DNS manager, click view --> advanced.

When you open a DNS record, there will be a new field for TTL which reveals the set TTL value. 

[aaobuhov]

My colleagues reported that TTL on the DNS server is 1 minute for local records.