DNS for Prisma Access
Focus
Focus
Prisma Access

DNS for Prisma Access

Table of Contents

DNS for
Prisma Access

Where Can I Use This?
What Do I Need?
  • Prisma Access (Cloud Management)
  • Prisma Access (Panorama Managed)
Prisma Access
allows you to specify DNS servers to resolve both domains that are internal to your organization and external domains. Do this to provide access to services on your corporate network—like LDAP and DNS servers—especially if you plan to set up service connections to provide access to these type of resources at HQ or in data centers.
Prisma Access
supports DNS resolution for mobile users- Global Protect and remote networks deployments. DNS queries for domains in the Internal Domain List are sent to your local DNS servers to ensure that resources are available to Prisma Access remote network users and mobile users.
For example, if you want a DNS lookup for your corporate domain to go exclusively to the corporate DNS server, specify the corporate domain and the corporate DNS servers here. To ensure that endpoints use the
DNS Proxy IP Address
, they must be configured to resolve DNS via the IP address shown in
Workflow
Prisma Access Setup
Prisma Access
Prisma Access DNS Proxy IP Address
.

Cloud Management

Enable
Prisma Access
to resolve both internal and public domains. You can choose to use
Prisma Access
DNS or let
Prisma Access
leverage your organization’s DNS setup.
Here’s how to set up
Prisma Access
to resolve internal domains, and how to customize DNS settings (to resolve both internal and public domains) for mobile user deployments and remote network sites.
  • Set up internal domain lists that apply to all traffic.
    1. Select
      Manage
      Service Setup
      Shared
      and
      Add Internal Domain List
      .
      If you're using Strata Cloud Manager, go to
      Workflows
      Prisma Access
      Setup
      Prisma Access
      and
      Add Internal DNS Servers
      .
    2. Enter the primary DNS server and secondary DNS server that Prisma Access should use to resolve the internal domain names.
    3. Add the internal domain names to send to these DNS servers for resolution.
      You can use a wildcard (*) in front of the domains in the domain list, for example *.acme.local or *.acme.com.
  • Add internal domain lists that apply only to specific mobile user deployments or remote network sites.
    1. Configure DNS settings:
      • Mobile Users
        —Go to
        Manage
        Service Setup
        Mobile Users
        Mobile Users Setup
        Infrastructure Settings
        and find
        Client DNS
        .
        If you're using Strata Cloud Manager, go to
        Workflows
        Prisma Access
        Setup
        GlobalProtect
        Infrastructure Settings
        find
        Client DNS
        .
      • Remote Networks
        —Go to
        Manage
        Service Setup
        Remote Networks
        Remote Networks Setup
        Advanced Settings
        and find
        DNS Proxy
        .
        If you're using Strata Cloud Manager, go to
        Workflows
        Prisma Access
        Setup
        Remote Networks
        Advanced Settings
        find
        DNS Proxy
        .
    2. Use the Worldwide default (the
      Prisma Access
      default DNS server) or customize settings based on region. In either case, select the region to adjust and customize the DNS settings for that region.
    3. Check the option to
      use these DNS settings to resolve internal domains
      and optionally
      Use the internal DNS Server for resolving public domains too
      . If you don’t select this option,
      Prisma Access
      uses its cloud default DNS server to resolve requests for public domains.
    4. Allow traffic from all addresses in your mobile user IP address pool to-your DNS servers.
      The DNS proxy in
      Prisma Access
      sends the requests to the DNS servers you specify. The source address in the DNS request is the first IP address in the IP pool you assign to the region. To ensure that your DNS requests can reach the servers you will need to make sure that you allow traffic from all addresses in your mobile user IP address pool to your DNS servers.

Panorama

Prisma Access
allows you to specify DNS servers to resolve both domains that are internal to your organization and external domains.
Set up
Prisma Access
to resolve internal domains.
  • Set up internal domain lists that apply to all traffic.
    1. Select
      Panorama
      Cloud Services
      Configuration
      Service Setup
      and click the gear icon to edit the Settings.
    2. Select the
      Internal Domain List
      tab.
    3. Add the Domain Names, Primary DNS, and Secondary DNS servers that you want
      Prisma Access
      to use to resolve your internal domain names.
      You can use a wildcard (*) in front of the domains in the domain list, for example *.acme.local or *.acme.com.
  • Add internal domain lists that apply only to specific mobile user deployments or remote network sites.
    1. Configure DNS settings:
      • Mobile Users
        —Go to
        Panorama
        Cloud Services
        Configuration
        Mobile Users - GlobalProtect
        and select the external gateway > and click
        Network Services
        .
      • Remote Networks
        —Go to
        Panorama
        Cloud Services
        Configuration
        Remote Networks
        >
        Settings
        >
        DNS Proxy
        .
    2. Use the Worldwide default (the
      Prisma Access
      default DNS server) or customize settings based on region. In either case, select the region to adjust and customize the DNS settings for that region.
    3. Add one or more rules to configure the DNS settings for
      Internal Domain
      .
      • Enter a unique Rule Name for the rule.
      • You want your internal DNS server to only resolve the domains you specify, enter the domains to resolve in the Domain List. Specify an asterisk in front of the domain; for example, *.acme.com. You can specify a maximum of 1,024 domain entries.
        Prisma Access
        has a predefined rule to resolve *.amazonaws.com domains using the Cloud Default server. If you want your internal DNS servers to resolve a more-specific *.amazonaws.com domain (for example, *.s3.amazonaws.com), enter the URL in the Domain List.
        Prisma Access
        evaluates the domain names from longest to shortest, then from top to boom in the list.
      • If you have a Custom DNS server that can access your internal domains, specify the Primary DNS and Secondary DNS server IP addresses, or select Use Cloud Default to use the default
        Prisma Access
        DNS server.
    4. Specify the DNS settings for
      Public Domains
      .
      • Use Cloud Default
        —Use the default Prisma Access DNS server.
      • Same as Internal Domains
        —Use the same server that you use to resolve internal domains. When you select this opon, the DNS Server used to resolve public domains is same as the server configured for the first rule in the
        Internal Domains
        section.
      • Custom DNS server
        —If you have a DNS server that can access your public (external) domains, enter the Primary DNS server address in that field.
    5. (
      Optional
      ) You can Add a DNS Suffix to specify the suffix that the client should use locally when an unqualified hostname is entered that it cannot resolve, for example, acme.local. Do Prisma Access Administrator’s Guide (Panorama Managed) not enter a wildcard (*) character in front of the domain suffix (for example, acme.com). You can add multiple suffixes.
    6. Allow traffic from all addresses in your mobile user IP address pool to-your DNS servers.
      The DNS proxy in
      Prisma Access
      sends the requests to the DNS servers you specify. The source address in the DNS request is the first IP address in the IP pool you assign to the region. To ensure that your DNS requests can reach the servers you will need to make sure that you allow traffic from all addresses in your mobile user IP address pool to your DNS servers.

Recommended For You