Paloalto cannot resolve specific FQDN through Nslookup & "fqdn refresh" is not working on CLI console

[JoHyeonJae]

Hello all,

Our client company uses FQDN A and B that Nslookup the same IP, and the firewall has a DNS access policy applied with these FQDN.

Recently, the customer deleted the DNS of B, and if it is normal operation, it should be normal service with FQDN of A, but DNS blocking issue occurred.

In addition, entering FQDN refresh from the CLI does not apply, and only when a commit is made through the GUI, the IP permit policy lookup to domain B of the actual device is applied.

It is confirmed that the policy is applied after committing through the GUI console, but I want to know why it is not applied when you try "fqdn refresh" in the CLI.

Best and Regards,

[Metgatz · Accepted solution]

Hello @JoHyeonJae 

Every time you apply a commit, a refresh of the FQDNs is executed.

Now how long have you set the FQDN refresh time globally in the AP ? Maybe you could adjust it more to your convenience.

Now to force by CLI you apply a:
request system fqdn refresh force yes

And then to be able to observe the setting: request system fqdn show

You can also try with a Ping.

Regards

[JoHyeonJae]

@Metgatz 

The customer has set FQDN refresh time as 30 (default) globally in the AP and I tried to "request system fqdn refresh force yes", but it is not applied.