FQDN TTL shorter than refresh time

[MortensenKnud]

I have a problem with some sites that uses DNS round robin as loadballancer.

As an examble:

vs-ssh.visualstudio.com

This has the TTL set to 300 sec, the PA's FQDN refresh is default 30 min.

So the firewall won't cache all IP's used in the round robin, because when it does a refresh the old value has timed-out

So the rule where I use the FQDN object fails periodic.

Is there a way to ignore the TTL value, not generally, but for indivually entries in the FQGN cache?

Rgds Knud

[Raido_Rattameister]

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKbCAK

[MortensenKnud]

That was not exactly what I was asking for, I know you can change the refresh time, but that wont solve the problem.

I need to be able to configure an alternative TTL per FQDN so instead of having a 5 min TTL I could configure the PA to ignore the TTL in the DNS reply and configure the cache to 24 hours, but only for that entry.

[Raido_Rattameister]

Either DNS Proxy static entries or some external cron job to resolve names to IPs and then push results to Palo through API as often as needed.