Problem DNS Resolution

[H.Leoesa]

Hi Guys,
I have an issue in my Prisma, its look like when i get spesific ip pool like x.x.a.a. I cant reach the server DNS.
Maybe anyone have an issue like me? I need help
Thanks!

[domari]

Hello @H.Leoesa, 

1. Can you please elaborate on how you determined that you are not able to reach the dns server? Are you seeing any deny traffic logs or are you seeing that the browser cannot resolve dns?
2. Are you using an internal DNS server, cloud default or custom DNS for Prisma Access? 
3. Are there any security policy rules that could be blocking this IP pool? 

[DavidRamazetti]

I am having a similar issue. Here is my setup,

 Global Protect is setup for two internal domains (not using actual names)

            acme.com    192.168.0.100  (pri)   192.168.0.101 (sec)

             lab.acme.com   172.16.31.5 (pri)   172.16.31.10 (sec)

             For public DNS, use prisma access DNS

             Setup for Split Tunneling

For testing, If I try and go to anything via DNS, fails. If I go via IP, works

                          If I try DNS to the GP DNS server, it fails.

                                While performing the above, Wireshark on the DNS servers, shows no connection attemps

                                                                                                   PA Firewall never shows any DNS requests over the SC tunnel

If I run a nslookup and change the server to the lab.acme.com server via IP address, DNS lookups are working and I see DNS on both the PA firewall of the SC along with the Wireshark capture.

I have tried disabling split tunneling, along with not using the PA dns servers for public domains, none of this has worked. Also, tried TLS decrpytion disabled, and none of this has made a change.

Any suggestions would be greatly appreciated. Also to note, this is managed by Strata Cloud Managed not Panorama