DNS Proxy Settings
Table of Contents
9.1 (EoL)
Expand all | Collapse all
-
- Objects > Addresses
- Objects > Address Groups
- Objects > Regions
- Objects > Dynamic User Groups
- Objects > Application Groups
- Objects > Application Filters
- Objects > Services
- Objects > Service Groups
- Objects > External Dynamic Lists
- Objects > Custom Objects > Spyware/Vulnerability
- Objects > Custom Objects > URL Category
- Objects > Security Profiles > Antivirus
- Objects > Security Profiles > Anti-Spyware Profile
- Objects > Security Profiles > Vulnerability Protection
- Objects > Security Profiles > File Blocking
- Objects > Security Profiles > WildFire Analysis
- Objects > Security Profiles > Data Filtering
- Objects > Security Profiles > DoS Protection
- Objects > Security Profiles > GTP Protection
- Objects > Security Profiles > SCTP Protection
- Objects > Security Profile Groups
- Objects > Log Forwarding
- Objects > Authentication
- Objects > Decryption > Forwarding Profile
- Objects > Schedules
-
-
- Firewall Interfaces Overview
- Common Building Blocks for Firewall Interfaces
- Common Building Blocks for PA-7000 Series Firewall Interfaces
- Tap Interface
- HA Interface
- Virtual Wire Interface
- Virtual Wire Subinterface
- PA-7000 Series Layer 2 Interface
- PA-7000 Series Layer 2 Subinterface
- PA-7000 Series Layer 3 Interface
- Layer 3 Interface
- Layer 3 Subinterface
- Log Card Interface
- Log Card Subinterface
- Decrypt Mirror Interface
- Aggregate Ethernet (AE) Interface Group
- Aggregate Ethernet (AE) Interface
- Network > Interfaces > VLAN
- Network > Interfaces > Loopback
- Network > Interfaces > Tunnel
- Network > Interfaces > SD-WAN
- Network > VLANs
- Network > Virtual Wires
-
- Network > Network Profiles > GlobalProtect IPSec Crypto
- Network > Network Profiles > IPSec Crypto
- Network > Network Profiles > IKE Crypto
- Network > Network Profiles > Monitor
- Network > Network Profiles > Interface Mgmt
- Network > Network Profiles > QoS
- Network > Network Profiles > LLDP Profile
- Network > Network Profiles > SD-WAN Interface Profile
-
-
- Device > Setup
- Device > Setup > Management
- Device > Setup > Interfaces
- Device > Setup > Telemetry
- Device > Setup > Content-ID
- Device > Setup > WildFire
- Device > Log Forwarding Card
- Device > Config Audit
- Device > Administrators
- Device > Admin Roles
- Device > Access Domain
- Device > Authentication Sequence
-
- Security Policy Match
- QoS Policy Match
- Authentication Policy Match
- Decryption/SSL Policy Match
- NAT Policy Match
- Policy Based Forwarding Policy Match
- DoS Policy Match
- Routing
- Test Wildfire
- Threat Vault
- Ping
- Trace Route
- Log Collector Connectivity
- External Dynamic List
- Update Server
- Test Cloud Logging Service Status
- Test Cloud GP Service Status
- Device > Virtual Systems
- Device > Shared Gateways
- Device > Certificate Management
- Device > Certificate Management > Certificate Profile
- Device > Certificate Management > OCSP Responder
- Device > Certificate Management > SSL/TLS Service Profile
- Device > Certificate Management > SCEP
- Device > Certificate Management > SSL Decryption Exclusion
- Device > Response Pages
- Device > Server Profiles
- Device > Server Profiles > SNMP Trap
- Device > Server Profiles > Syslog
- Device > Server Profiles > Email
- Device > Server Profiles > HTTP
- Device > Server Profiles > NetFlow
- Device > Server Profiles > RADIUS
- Device > Server Profiles > TACACS+
- Device > Server Profiles > LDAP
- Device > Server Profiles > Kerberos
- Device > Server Profiles > SAML Identity Provider
- Device > Server Profiles > DNS
- Device > Server Profiles > Multi Factor Authentication
- Device > Local User Database > Users
- Device > Local User Database > User Groups
- Device > Scheduled Log Export
- Device > Software
- Device > Dynamic Updates
- Device > Licenses
- Device > Support
-
- Network > GlobalProtect > MDM
- Network > GlobalProtect > Device Block List
- Network > GlobalProtect > Clientless Apps
- Network > GlobalProtect > Clientless App Groups
- Objects > GlobalProtect > HIP Profiles
-
- Use the Panorama Web Interface
- Context Switch
- Panorama Commit Operations
- Defining Policies on Panorama
- Log Storage Partitions for a Panorama Virtual Appliance in Legacy Mode
- Panorama > Setup > Interfaces
- Panorama > High Availability
- Panorama > Administrators
- Panorama > Admin Roles
- Panorama > Access Domains
- Panorama > Device Groups
- Panorama > Plugins
- Panorama > Log Ingestion Profile
- Panorama > Log Settings
- Panorama > Scheduled Config Export
End-of-Life (EoL)
DNS Proxy Settings
Click Add and configure the firewall
to act as a DNS proxy. You can configure a maximum of 256 DNS proxies
on a firewall.
DNS Proxy Settings | Configured In | Description |
---|---|---|
Enable | DNS Proxy | Select to enable this DNS proxy. |
Name | Specify a name to identify the DNS proxy
object (up to 31 characters). The name is case-sensitive
and must be unique. Use only letters, numbers, spaces, hyphens,
and underscores. | |
Location | Specify the virtual system to which the
DNS proxy object applies:
| |
Inheritance Source (Shared location only) | Select a source from which to inherit default
DNS server settings. This is commonly used in branch office deployments
where the firewall's WAN interface is addressed by DHCP or PPPoE. | |
Check inheritance source status (Shared location only) | Select to see the server settings that are currently
assigned to the DHCP client and PPPoE client interfaces. These may
include DNS, WINS, NTP, POP3, SMTP, or DNS suffix. | |
Primary/Secondary (Shared location only) | Specify the IP addresses of the default
primary and secondary DNS servers to which this firewall (as DNS
proxy) sends DNS queries. If the primary DNS server cannot be found,
the firewall uses the secondary DNS server. | |
Server Profile (Virtual System
location only) | Select or create a new DNS server profile.
This field does not appear if the Location of virtual systems was
specified as Shared. | |
Interface | Add an interface
to function as a DNS proxy. You can add multiple interfaces. To
remove the DNS proxy from an interface, select and Delete it. An
interface is not required if the DNS Proxy is used only for service
route functionality. Use a destination service route with a DNS
proxy with no interface if you want the destination service route
to set the source IP address. Otherwise, the DNS proxy selects an
interface IP address to use as a source (when no DNS service routes
are set). | |
Name | DNS ProxyDNS Proxy Rules | A name is required so that an entry can
be referenced and modified via the CLI. |
Turn on caching of domains resolved by this mapping | Select to enable caching of domains that
are resolved by this mapping. | |
Domain Name | Add one or more domain
names to which the firewall compares incoming FQDNs. If the FQDN
matches one of the domains in the rule, the firewall forwards the
query to the Primary/Secondary DNS server specified for this proxy. To
delete a domain name from the rule, select it and click Delete. | |
DNS Server Profile (Shared location only) | Select or add a DNS server profile to define
DNS settings for the virtual system, including the primary and secondary
DNS server to which the firewall sends domain name queries. | |
Primary/Secondary (Virtual System
location only) | Enter the hostname or IP address of the
primary and secondary DNS servers to which the firewall sends matching
domain name queries. | |
Name | DNS ProxyStatic Entries | Enter a name for the static entry. |
FQDN | Enter the Fully Qualified Domain Name (FQDN)
to map to the static IP addresses defined in the Address field. | |
Address | Add one or more IP addresses
that map to this domain. The firewall includes all of these addresses
in its DNS response, and the client chooses which IP address to
use. To delete an address, select the address and click Delete. | |
TCP Queries | DNS ProxyAdvanced | Select to enable DNS queries using TCP.
Specify the maximum number of concurrent pending TCP DNS requests
(Max Pending Requests) that the firewall
will support (range is 64-256; default is 64). |
UDP Queries Retries | DNS ProxyAdvanced | Specify settings for UDP query retries:
|
Cache | DNS ProxyAdvanced | You must have Cache enabled
(enabled by default) if this DNS proxy object is used for queries
that the firewall generates (that is, under DeviceSetupServicesDNS,
or under DeviceVirtual Systems and
you select a virtual system and GeneralDNS Proxy). Then specify the following:
|