FQDN refresh failed

[darrenclegg]

We have 4 PaloAlto clusters and a FQDN refresh works on 3 of the clusters but not the 4th. All objects are shared on the 4 clusters. I have tried:

Scheduled refresh of FQDN fails

Manual refresh of FQDN fails

Changed the FQDN refresh time.

I can ping the DNS server from the Management Interface.

If i ping a DNS it resolves.

If I create a FQDN object it resolves.

but when I run request system fqdn show it states that no objects were resolved.

I have checked the logs (output below):

2019-03-12 11:46:25.988 +0000 dnscfgmod: FQDN Refresh: Periodic Force Refresh
2019-03-12 11:46:25.989 +0000 dnscfgmod: Main refresh function: (Force Refresh)
2019-03-12 11:46:25.989 +0000 dnscfgmod:Fqdn refresh job 496 scheduled
2019-03-12 11:46:25.989 +0000 FqdnRefresh job started processing. Dequeue time=2019/03/12 11:46:25
2019-03-12 11:46:30.863 +0000 dnscfgmod: Resolving fqdns took 5 secs
2019-03-12 11:46:30.863 +0000 Fqdn refresher thread device requested last config
2019-03-12 11:46:43.052 +0000 Error: pan_cfg_dnscfg_refresh_fqdns(pan_cfg_dnscfg.c:4340): Failed to refresh the fqdn.
2019-03-12 11:46:43.122 +0000 Error: pan_jobmgr_process_job(pan_job_mgr.c:2904): Fqdn Refresh job failed

 Can anyone help?

[OtakarKlier]

Hello,

Verify the service route to make sure that interface has access to the requested DNS servers. If you have not changed them the default is the management interface. Is there a PAN or security policy between the MGMT interface and the DNS servers? If yes, check the logs to see if/where it is getting blocked.

Hope that helps.

[darrenclegg]

I checked all the settings again and they are set exactly the same for all 4 clusters we have. On Monday morning the FQDN refresh job worked successfully and has continued to work since. I do not know why it was not working or how it was fixed as no changes were made. hay-ho I am happy it is working for now.