nslookup on the management port ?

[DSTR]

I would like to check a few DNS issues I'm seeing on the management port.

I had hoped to find nslookup in the CLI, but it isn't there.

Is there something equivalent ?

Thanks.

[gwesson]

There is no nslookup command, but you can do a simple ping. Even if the destination doesn't allow ping, the DNS lookup will still happen. The command to ping from the management interface is:

ping host www.example.com

You will want to ensure that you are not using a service route though, as the DNS requests are all sent using that service route. The service routes are configured at Device > Setup > Services > Service Route Configuration. If you do have a service route set, your ping and all DNS lookups where the firewall initiates connections (such as updates.paloaltonetworks.com) will use that route.

Hope this helps,

Greg

[HULK]

Hello DSTR,

As per my knowledge, PAN CLI does have an option like "nslookup" in windows. But, you can verify the DNS functionality, wthere FQDN resolves to a valid IP address from the DNS server.

admin> ping host google.com

PING google.com (173.194.115.70) 56(84) bytes of data.  >>>>>>>>>>>>>>>>>>>>> Configured DNS server resolved the FQDN address to IP address.

64 bytes from dfw06s41-in-f6.1e100.net (173.194.115.70): icmp_seq=1 ttl=55 time=40.6 ms

64 bytes from dfw06s41-in-f6.1e100.net (173.194.115.70): icmp_seq=2 ttl=55 time=37.1 ms

64 bytes from dfw06s41-in-f6.1e100.net (173.194.115.70): icmp_seq=3 ttl=55 time=39.4 ms

Thanks

[Royalfr]

If you HTTPS to the firewall and create an Address as an FQDN instead of an IP, there is a clickable RESOLVE link next to where you place the DNS name. That will resolve and list all the IP addresses it pulled from DNS.  This is better than a PING test as PING will only show the first of many IPs.  Using the FQDN address object you can see the full list.

[Kobiher]

great solution that replaces nslookup perfectly, thank you 🙂