11-06-2025 02:56 PM
I'm encountering and issue where we are seeing duplicate DNS (UDP) packets coming out of the palo to the resolving server. Specifically TXT records with multiple packets at the server (resolver) side vs. the normal request/response. At the client side we see the normal request response (2 packets). The server side there are up to 6 packets for the same request.
11-07-2025 04:37 AM
Hi,
that usually happens when DNS inspection or ALG is enabled and the firewall re-transmits or duplicates packets as part of its flow handling. Palo Alto can resend UDP requests if it doesn’t see a quick response or if session aging is aggressive.
Check whether DNS Security or UDP session timeout is causing retries. You can also disable DNS proxy inspection on that policy to confirm if the duplication stops.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
