Prisma Access
DNS Resolution for Remote Networks
Table of Contents
DNS Resolution for Remote Networks
Learn about DNS resolution for Prisma Access Remote Network
deployments.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
|
If you have an existing remote network deployment, you can continue
to use the DNS resolution methods that you already have in place,
or you can use Prisma Access to proxy the DNS request. Proxying
the DNS requests allows you to send DNS requests for public domains
to one server and send DNS request for internal domains to another
server.
The following figure shows a DNS request to a deployment where an internal DNS
server is used to process requests for both internal and external domains. In this case,
you don't need to use a remote network as DNS proxy.
In this example, the remote network IP address is 35.1.1.1 and the loopback IP address is
10.172.37.1. Since Prisma Access does not proxy the requests, the source IP of the
DNS request is 10.1.1.1 (the IP address of Client 1’s device in the remote network
site).
If the DNS requests for internal domains being resolved by the DNS server in
the headquarters or data center location, while requests for external domains are
resolved using a third-party or public DNS server accessible through the internet, Prisma Access proxies the DNS request:
- For DNS requests for internal domains, the source IP address is the loopback IP address (10.172.37.1 in this example).
- For DNS requests for external domains, the source IP address is the service endpoint address of the remote network (35.1.1.1 in this example).
In order to use Prisma Access to proxy DNS requests for the clients in your remote network,
you also need to configure the remote network DNS proxy IP address as the DNS server
in your network configuration, which is outside of Prisma access. You can retrieve
the Remote Network DNS IP Address from for Prisma Access (Managed by Strata Cloud Manager)deployments or for Prisma Access (Managed by Panorama) deployments.
In the following example, 172.1.255.254 is the remote network DNS proxy IP address
that you configure as the DNS server to proxy DNS requests coming from Prisma Access
remote network users.
