Shows the possible configurations you can use for Prisma
Access to resolve DNS queries for mobile users and remote networks.
| Where Can I Use
This? | What Do I Need? |
|---|
Prisma Access allows you to specify DNS servers to resolve
both domains that are internal to your organization and external
domains. Prisma Access proxies the DNS request based on the configuration
of your DNS servers. The following table shows the supported DNS
resolution methods for internal and external domains and indicates
when Prisma Access proxies the DNS requests.
| Internal DNS Resolution Method | External DNS Resolution Method | Prisma Access Proxies the DNS Request (Yes/No) |
|---|
| Single rule, DNS server configured for Internal
Domains | Cloud Default (Google Public DNS64 for
IPv6) | Yes |
| Single rule, DNS server configured for Internal
Domains | Same as Internal Domains | No |
| Single rule, DNS server configured for Internal
Domains | Custom DNS server (Google Public DNS64 for
IPv6) | Yes |
| Single rule, Cloud Default set for a domain | Cloud Default (Google Public DNS64 for
IPv6) | Yes |
| Single rule, Cloud Default set for a domain | Same as Internal Domains (Google Public DNS64 for
IPv6) | Yes |
| Single rule, Cloud Default set for domain | Custom DNS server (Google Public DNS64 for
IPv6) | Yes |
| Multiple rules, DNS server configured for Internal
Domains | Cloud Default (Google Public DNS64 for
IPv6) | Yes |
| Multiple rules, DNS server configured for Internal
Domains | Same as Internal Domains | Yes |
| Multiple rules, DNS server configured for Internal
Domains | Custom DNS server (Google Public DNS64 for
IPv6) | Yes |
| No configuration | Custom DNS Server (Google Public DNS64 for
IPv6) | Yes |
| No configuration | Cloud Default (For IPv6, Primary = Google Public
DNS64, Secondary = Cloud Default) | No |
| No configuration | No configuration | No |
| No DNS resolution specified (default configuration
is present, which uses Cloud Default) | No DNS resolution specified | No |
| ZTNA Connector (regardless of DNS resolution
method) | N/A | Yes |
|
The
following guidelines and restrictions apply to using DNS resolution
with Prisma Access:
The maximum number of concurrent
pending TCP DNS requests ( Max Pending Requests)
that Prisma Access supports is 64.
For UDP queries, the DNS proxy sends another request if it
hasn’t received a response in 2 seconds, and retries a maximum of
5 times before trying the next DNS server.
Prisma Access caches the DNS entries with a time-to-live
(TTL) value of 300 seconds. EDNS responses are also cached.
See these procedures for DNS resolution for agent-based and remote network
deployments:
