New DNS configuration issue

[Raghav_B]

Hi All,

I have coinfigured a new DNS server on Palo Alto device. However, it is still sending queries to the old DNS servers.

Please help.

Regards,

Raghav

[BPry]

Where exactly are you trying to setup DNS? Is this for DNS Proxy, the DNS for the firewall as a whole? Not alot to go off of here since I'm not sure which one your actually talking about but it sounds like you either haven't committed the change, added the new DNS server as a secondary, or for some reason it's keeping a session open with your old DNS server and using that session to query any new requests.

[TranceforLife]

+1 @BPry most likely changes are not committed 

[Raghav_B]

I have added a new DNS server as a primary DNS server on firewall, secondary DNS address is kept same on firewall.

Ans it is not DNS proxy, just a normal DNS server address that is added to the firewall( Device > Setup > Services > DNS

Changes are committed to the device.

[Raghav_B]

Changes are committed to the firewall ( Commit button is greyed out, since there is no difference between running and candidate config).

Please advise.

Regards,

Raghav

[TranceforLife]

Hello Raghav,

How do you know that the firewall is using an old server rather than the new? Do you see traffic logs or got a PCAP from the firewall

Thx,

Myky

[kdd]

Hello Raghav,

please verify also the "Service Route Configuration" for your DNS-Server. You will find it here: Device > Setup > Services > Global > Services Features.

Regards,

Klaus

[Raghav_B]

I don't see logs on Monitor tab, however when I get a PCAP - I see only old DNS server hostname. Also DNS confirmed that firewall is querying old DNS server.

Regards,

Raghav

[Raghav_B]

Service Route Configuration is not changed, it is default through Management port for DNS traffic. I can try changing the route of DNS traffic to any in-band port and confirm.

But I don't see this to be the issue.

Please guide.

Regards,

Raghav 

[TranceforLife]

Hi,

You are correct. Service route option will change the way you get to the specific source/destination.

Don't really know how this happens but the firewall will alway do exactly what you told it to do but this is not always what we want)))

P.S I just tested on my firewall and it does the same, talking to the old DNS server. Getting more interesting)

Thx,

Myky

[kiwi · Accepted solution]

Hi @Raghav_B,

Are you by any chance using an older PAN-OS version ?

From the PAN-OS 7.1.2 release notes (Addressed issues) :

The firewall does not update some processes as expected (such as mgmtsrvr, reportd, logd, and pan_log_receiver) when you specify a new DNS server (Device > Setup > Services [> Global]), which causes the firewall to continue forwarding some DNS requests to the previously configured DNS server instead of the current one.

Cheers,

-Kim.

[TranceforLife]

Hi,

I am on 7.1.6 so l restarted a data plane  and it seems like resolved the issue. Now l can see queries are  going to the new DNS.

@Raghav_B what is your version? 

Thx,

Myky

[Raghav_B]

Thanks Myky, I am going to upgrade to 7.1.6, then restart the data plane. Will keep you posted, if issue persists.

Regards,

Raghav

[Raghav_B]

I am running on PAN OS 7.1.2, let me upgrade to 7.1.6. I will check and keep you updated.

Thanks for the information, really helpful :).

Regards,

Raghav

[TranceforLife]

Hiya,

If you will perform an update you have to reboot the box in order for the new PAN-OS take effect. So no need to reboot data plane after.

Good luck,

Myky