Palo Alto unable to resolve its own static entries

[ciscojuniperf5]

Palo Alto unable to resolve its own static entries

When I try ping host abc.com

it says ping : abc.com : System error

How do I fix this?

There is a static entry for abc.com on the palo alto

[mshekh]

Hi @ciscojuniperf5 ,

Thanks for info however provided info is not enough to comment on resolution however please refer the below kb for more details related to configuration as it looks like some configuration issue.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFcCAK

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClLxCAK

[ciscojuniperf5]

Hi @mshekh 

Those settings are same on a firewall where it is working and this firewall where it not working. I am confused now as to where is the issue.

[ciscojuniperf5]

Its a PA-440 on version 11.2.4-h1

[mshekh]

Hi @ciscojuniperf5 ,

Thanks for info, please open a support case and work with TAC team for further investigation if settings are correct.

[emr_1]

At least you need to take care of two locations.

One is DNS proxy as mentioned in previous post:

Secondary, you need to configure to use dns proxy by system (pan device itself) as below:

Here is my result:

====

admin@PA-455> ping host abcsampledomain.com  <<< Before configuring above two
ping: abcsampledomain.com: System error

admin@PA-455> show dns-proxy static-entries all

Name: dnsproxy
Static Entries: 2
Domain IP/Name Type Class TTL Hits Static
-----------------------------------------------------------------------------------------------------------------------------
4.3.2.1.in-addr.arpa abcsampledomain.com PTR IN 0 0 config
abcsampledomain.com 1.2.3.4 A IN 0 0 config

admin@PA-455> ping host abcsampledomain.com <<< After configuring above two
PING abcsampledomain.com (1.2.3.4) 56(84) bytes of data. <<< you can see IP address

====

[ciscojuniperf5]

I have these configured similar on both working and non working firewall

[mshekh]

Hi @ciscojuniperf5 ,

I will suggest you to open a tac case and work with Tac team to troubleshoot further.