Configure Dynamic DNS for Firewall Interfaces

Configure the firewall to use a DDNS service to update your changing domain name-to-IP address mappings so it provides accurate IP address resolutions to its clients.
Before you configure DDNS for a firewall interface:
  • Determine the hostname that you registered with your DDNS provider.
  • Obtain the public SSL certificate from the DDNS service and import it in to the firewall.
  • (
    If you use FreeDNS Afraid.org v1 or FreeDNS Afraid.org Dynamic API v1
    ) On the DDNS server, the Dynamic DNS service tab includes the following option:
    Link updates of the same IP together?
    When this option is enabled, the DDNS service updates all hostnames in DNS records that contain the old IP address that is changing, not just the DNS record for a single hostname and IP address. To avoid updating DNS records of hosts you didn’t intend to update, you should disable the
    Link updates of the same IP together?
    option so that the DDNS server updates only the DNS record that contains the specific hostname with the new IP address that is in the DDNS update.
  1. Configure DDNS.
    1. Select
      Network
      Interfaces
      Ethernet
      and select a Layer 3 interface, subinterface, or Aggregate Ethernet (AE) interface; or select
      Network
      Interfaces
      VLAN
      and select an interface or subinterface.
    2. Select
      Advanced
      DDNS
      and select
      Settings
      .
    3. Enable
      DDNS. You must initially enable DDNS to configure it. (If your DDNS configuration is unfinished, you can save it without enabling it so that you do not lose your partial configuration.)
    4. Enter the
      Update Interval (days)
      , which is the number of days between updates that the firewall sends to the DDNS service to update IP addresses mapped to FQDNs (default is 1; range is 1 to 30). Choose an interval based on how frequently your IP addresses change. (The updates that the firewall sends at regular intervals are in addition to the updates the firewall sends upon receiving an address change. The updates sent at regular intervals are to ensure that updates sent per address change are not lost, for example.)
    5. Enter the
      Hostname
      for the interface, which is already registered with the DDNS service (for example, www.serverA.companyx.com or serverA).
      Make sure this hostname matches the hostname you registered with your DDNS service. You should enter an FQDN for the hostname; the firewall doesn’t validate the hostname except to confirm that the syntax uses only valid characters allowed by DNS for a domain name.
    6. Select
      IPv4
      and select one or more IPv4 addresses assigned to the interface or
      Add
      an IPv4 address to associate with the hostname (for example, 10.1.1.1). You can select only as many IPv4 addresses as the DDNS service allows. All selected IPv4 addresses are registered with the DDNS service. Select at least one IPv4 or one IPv6 address.
    7. Select
      IPv6
      and select one or more IPv6 addresses assigned to the interface or
      Add
      an IPv6 address to associate with the hostname. You can select only as many IPv6 addresses as the DDNS service allows. All selected IPv6 addresses are registered with the DDNS service. Select at least one IPv4 or one IPv6 address.
    8. Select or create a new certificate profile (
      Certificate Profile
      ) using the imported SSL certificate from the DDNS service to verify the SSL certificate of the DDNS service when the firewall first connects to a DDNS service to register an IP address and at every update. When the firewall connects to the DDNS service to send updates, the DDNS service presents the firewall with an SSL certificate signed by the certificate authority (CA) so that the firewall can authenticate the DDNS service.
    9. Select the
      Vendor
      (and version number) you are using for DDNS service.
      ddns_screenshot.png
      Palo Alto Networks may change the supported DDNS service providers via a content update.
    10. The vendor choice determines the vendor-specific
      Name
      and
      Value
      fields below the Vendor field. Some Value fields are read-only to notify you of the parameters the firewall uses to connect to the DDNS service. Configure the remaining Value fields, such as a password that the DDNS service provides to you and a timeout that the firewall uses if it doesn’t receive an update from the DDNS service.
    11. Click
      OK
      .
  2. (
    Optional
    ) If you want the firewall to communicate with the DDNS service using an interface other than the management interface, configure a service route for DDNS (Set Up Network Access for External Services).
  3. Commit
    your changes.
  4. View DDNS information for the interface.
    1. Select
      Network
      Interfaces
      Ethernet
      or
      Network
      Interfaces
      VLAN
      and select the interface you configured. (Interfaces with DDNS configured display the DDNS icon— ddns-icon.png —in the Features field.)
    2. Select
      Advanced
      DDNS
      and
      Settings
      .
    3. Show Runtime Info
      to see the DDNS information for the interface, including the Last return code (result of the last FQDN update) and Last time (date and time) the DDNS service received an FQDN update.

Related Documentation