DNS based traffic shows incomplete when connected to GlobalProtect

[Salathiwe]

Hi all

I have an issue noticed that DNS-based traffic shows incomplete when users are connected to GlobalProtect.
The same traffic is fine when we disconnect from GlobalProtect 

[Raido_Rattameister]

DNS server is public?

GlobalProtect is in separate zone?

GlobalProtect zone is in SNAT outgoing policy?

[Salathiwe]

​-Is the DNS server public? no 

​-Is GP in a separate zone and NAT outgoing policy?yes 

[Salathiwe]

Hey anyone with a fix for this?

[aleksandar.astardzhiev]

Hi @Salathiwe ,

Just to clarify does your DNS actually work so user connected to GlobalProtect are able to resolve domains? Or you just noticed some DNS traffic that is incomplete, but there is no actual issues with name resolution?

If the traffic is sent to internal DNS server (that is behind your firewall) and it is incomplete, it looks like you need to troubleshoot the path from your firewall (more specifically GP IP pool range) to the internal DNS server.

And what do you mean by "same traffic is fine when GP is disconnected? Are you using GP tunnel mode when user is inside your LAN so it can still reach internal DNS?