Configure a Private External Dynamic List with an FQDN Source

Table of Contents

Configure a Private External Dynamic List

Configure a Private External Dynamic List with an FQDN Source

Configure a private external dynamic list (EDL) where the EDL server is identified by an FQDN that resolves through a private DNS server.

Where Can I Use This?	What Do I Need?
Cloud NGFW for Azure	Cloud NGFW subscription Palo Alto Networks Customer Support Portal account Azure Marketplace subscription Strata Cloud Manager access Private EDL configured as described in Configure a Private External Dynamic List, including VNet peering and the CNGFW-Azure-Loopback-3-Default snippet Private DNS server deployed in an Azure VNet that can resolve the private FQDN to the EDL server's IP address VNet peering and a user defined route (UDR) configured for the DNS server subnet

Where Can I Use This?

What Do I Need?

Cloud NGFW for Azure

Cloud NGFW subscription
Palo Alto Networks Customer Support Portal account
Azure Marketplace subscription
Strata Cloud Manager access
Private EDL configured as described in Configure a Private External Dynamic List, including VNet peering and the CNGFW-Azure-Loopback-3-Default snippet
Private DNS server deployed in an Azure VNet that can resolve the private FQDN to the EDL server's IP address
VNet peering and a user defined route (UDR) configured for the DNS server subnet

When your private EDL server is identified by an FQDN rather than a static IP address, and that FQDN is not registered in public DNS, Cloud NGFW for Azure cannot resolve it using its default DNS. You configure a DNS service route so the firewall sends DNS queries through the loopback.3 interface to a private DNS server that can resolve the private FQDN to the EDL server's IP address.

The following format requirements apply to the EDL FQDN source:

The full EDL source URL must not exceed 256 characters.
The FQDN itself must not exceed 253 characters.
Each label (segment between dots) must not exceed 63 characters.
Labels can contain letters (a-z), digits (0-9), and hyphens (-), but must not start or end with a hyphen.

If your EDL server FQDN belongs to a Microsoft-controlled domain, you can configure a DNS Proxy object to override Azure's built-in DNS and direct those queries to your private DNS server. See the optional step at the end of this procedure.

Set up Azure Private DNS so the FQDN of your EDL server resolves to its private IP address:
1. In the Azure portal, go to Private DNS zones and create a private DNS zone for your domain (for example, internal.contoso.com).
2. Add an A record mapping the EDL server FQDN to its private IP address (for example, map edl-server.internal.contoso.com to 10.1.0.4).
3. Link the private DNS zone to the VNet where the firewall's trust interface resides. If you use a custom DNS virtual machine instead of an Azure Private DNS Zone, ensure the virtual machine has the A record configured.
Configure the DNS service route in Strata Cloud Manager so Cloud NGFW for Azure resolves private FQDNs through loopback.3:
1. Log in to Strata Cloud Manager and select your Cloud NGFW for Azure folder.
2. If you have not already done so, import the CNGFW-Azure-Loopback-3-Default snippet.
3. Select DeviceDevice SetupService Route Settings and click Customize.
4. On the IPv4 tab, click DNS.
5. For Source Interface, choose loopback.3.
6. For Source Address, choose 172.200.255.253.
7. Click OK.
Configure VNet peering and a UDR on the DNS server subnet so it can route traffic back to the Cloud NGFW loopback.3 address:
1. If the DNS server VNet and the Cloud NGFW VNet are different, configure VNet peering between them.
2. Add a UDR to the DNS server subnet with the following settings:
  - Destination: 172.200.255.253/32
  - Next Hop Type: Virtual Appliance
  - Next Hop IP Address: the Cloud NGFW trust interface internal load balancer (ILB) private IP address
Create the EDL object with an FQDN source:
1. Select ObjectsExternal Dynamic List and click Add External Dynamic List.
2. For Name, enter a descriptive name for the EDL (for example, private-edl-fqdn).
3. For Type, choose IP List, URL List, or Domain List.
4. For Source, enter the FQDN-based URL of your EDL server (for example, http://edl-server.internal.contoso.com/ip.txt).
5. For Check Frequency, set the polling interval.
6. Click Save.
Select Security Policies and click Add to create a security rule that references the EDL object, then click Save.
(Optional) If your EDL server FQDN belongs to a Microsoft-controlled domain, configure a DNS Proxy object to direct those queries to your private DNS server:
1. Select Network & DeviceDNS Proxy and click Add DNS Proxy.
2. Click Add to add a match rule, enter the specific FQDN of your EDL server as the domain pattern (for example, edl-server.azure.com), and enter the private DNS server IP address as the primary DNS server. Use the exact FQDN rather than a wildcard pattern, a specific entry takes precedence over the wildcard prefix entries that Cloud NGFW for Azure adds by default.
3. Click Save.
4. Select Network & DeviceDevice SetupServices, click the settings icon to customize, and assign the DNS Proxy object you created.
5. Select Network & DeviceDevice SetupService Route Settings and click Customize. On the IPv4 tab, add a service route for the private DNS server and choose loopback.3 as the source interface.
Push Config to deliver the configuration to your Cloud NGFW for Azure firewalls.