DNS and Prisma Access (Cloud Management)

Enable Prisma Access to resolve both internal and public domains. You can choose to use Prisma Access DNS or let Prisma Access leverage your organization’s DNS setup.
Enable Prisma Access to resolve both internal and public domains. You can choose to use Prisma Access DNS or let Prisma Access leverage your organization’s DNS setup.

Configure Global DNS Settings

Here’s how to set up internal domain lists that apply to all traffic. Do this to provide access to services on your corporate network — like LDAP and DNS servers — especially if you plan to set up service connections to provide access to these type of resources at HQ or in data centers.
After you add your local DNS servers, Prisma Access will use them to resolve queries for the domains that you add to the internal domain list. This ensure that these internal resources are available to Prisma Access remote network users and mobile users.
To customize DNS settings (to resolve both internal and public domains) for GlobalProtect mobile users and remote network sites, Configure DNS for Mobile Users and Remote Networks.
  1. Select
    Manage
    Service Setup
    Shared
    and
    Add Internal Domain List
    .
  2. Enter the Primary DNS server and Secondary DNS server that Prisma Access should use to resolve the internal domain names.
  3. Add the internal domain names to send to these DNS servers for resolution.
    You can use a wildcard (*) in front of the domains in the domain list, for example *.acme.local or *.acme.com.

Configure DNS for Mobile Users and Remote Networks

You can customize DNS settings (to resolve both internal and public domains) for GlobalProtect mobile users and remote networks.
  1. Go to the DNS configuration settings for Mobile Users (GlobalProtect) or Remote Networks.
    Mobile Users (GlobalProtect)
    Go to
    Manage
    Service Setup
    GlobalProtect
    Infrastructure
    Infrastructure Settings
    Client DNS
    Remote Networks
    Go to
    Manage
    Service Setup
    Remote Networks
    Advanced Settings
    DNS Proxy
  2. Customize DNS settings for both internal and external domains.
    • Use the Worldwide default (the Prisma Access default DNS server) or
      customize per region
      .
    • Select a region to customize DNS settings for that region, for resolving both internal and external domains.
    • You can specify what DNS servers to use to
      resolve internal domains
      . To do this, add
      Internal Domain Resolve Rules
      .
      For each rule, add a list of domains and the primary and secondary DNS servers you’d like Prisma Access to use to resolve the domains on the list.
    • Specify the primary and secondary DNS servers for Prisma Access to use to
      resolve external domains
      :
      • Prisma Access Default
        — Use the default Prisma Access DNS servers to resolve external domains.
      • Internal DNS
        — Use the DNS servers specified in the
        first
        Internal Domain Resolve Rule to resolve external domains. (Prisma Access will resolve external domains based on the top Internal Domain Resolve Rule).
      • Custom
        — Specify a primary and secondary DNS servers for external domains to use.
    • Configure intervals and maximum attempts for
      UDP query retries
      :
      • Interval (sec)—The length of time (in seconds) after which another request is sent if no response has been received.
      • Attempts—The maximum number of UDP query attempts (excluding the first attempt) after which the next DNS server is queried.

How It Works—DNS and Prisma Access

Set up Prisma Access to resolve DNS queries for mobile users and remote networks.
Prisma Access provides you with different ways to resolve DNS queries for mobile users and remote networks. Continue here to learn more about:
  • DNS Resolution for Prisma Access
  • DNS Resolution for Mobile Users
  • DNS Resolution for Remote Networks

DNS Resolution for Prisma Access

Prisma Access allows you to specify DNS servers to resolve both domains that are internal to your organization and external domains. Prisma Access proxies the DNS request based on the configuration of your DNS servers. The following table shows the supported DNS resolution methods for internal and external domains and indicates when Prisma Access proxies the DNS requests.
Internal DNS Resolution Method
External DNS Resolution Method
Prisma Access Proxies the DNS Request (Yes/No)
Single rule, DNS server configured for Internal Domains
Cloud Default
Yes
Single rule, DNS server configured for Internal Domains
Same as Internal Domains
No
Single rule, DNS server configured for Internal Domains
Custom DNS server
Yes
Single rule, Cloud Default set for a domain
Cloud Default
Yes
Single rule, Cloud Default set for a domain
Same as Internal Domains
Yes
Single rule, Cloud Default set for domain
Custom DNS server
Yes
Multiple rules, DNS server configured for Internal Domains
Cloud Default
Yes
Multiple rules, DNS server configured for Internal Domains
Same as Internal Domains
Yes
Multiple rules, DNS server configured for Internal Domains
Custom DNS server
Yes
No configuration
Custom DNS Server
Yes
No configuration
Cloud Default
No
No configuration
No configuration
No
No DNS resolution specified (default configuration is present, which uses Cloud Default)
No DNS resolution specified
No
The source IP address of the DNS request depends on whether or not Prisma Access proxies the DNS request.
  • When Prisma Access does not proxy the DNS requests, the source IP address of the DNS request changes to the IP address of the device that requested the DNS lookup. This source IP address allows you to enforce source IP address-based DNS policies or identify endpoints that communicate with malicious domains. This behavior applies for both mobile users and remote network deployments.
  • When Prisma Access proxies the DNS requests, the source IP address of the DNS request changes to the following addresses:
    • Mobile User deployments
      —The source IP address of the DNS request is an IP address taken from the mobile user IP address pool for internal requests and the mobile user location’s gateway IP address for external requests.
    • Remote Network deployments
      —The source IP address of the DNS request is the EBGP Router Address for internal requests and the Service IP address of the remote network connection for external requests.
The following guidelines and restrictions apply to using DNS resolution with Prisma Access:
  • The maximum number of concurrent pending TCP DNS requests (
    Max Pending Requests
    ) that Prisma Access supports is 64.
  • For UDP queries, the DNS proxy sends another request if it hasn’t received a response in 2 seconds, and retries a maximum of 5 times before trying the next DNS server.
  • Prisma Access caches the DNS entries with a time-to-live (TTL) value of 300 seconds. EDNS responses are also cached.

DNS Resolution for Mobile Users

Here’s how Prisma Access processes the source IP address of the DNS requests after you configure DNS resolution.
The following figure show a deployment where you have assigned an internal DNS server to resolve both internal and external domains. In this case, Prisma Access does not proxy the DNS requests, and the DNS request is from Mobile User 1’s GlobalProtect client IP address. The GlobalProtect client assigns this IP address to the mobile user and it is taken from the Mobile User IP address pool.
The following figure shows the DNS requests for internal domains being resolved by the DNS server in the headquarters or data center location, while requests for external domains are resolved by Prisma Access’ Cloud Default DNS server. In this case, Prisma Access proxies the requests for the external request, and the source IP address is the mobile user location’s gateway IP address (15.1.1.1 in this example), while the internal source IP remains as Mobile User 1’s GlobalProtect client IP address.
The following figure shows the organization using a third-party or public DNS server accessible through the internet for requests to external domains. Prisma Access proxies these requests as well.

DNS Resolution for Remote Networks

The following figure shows a DNS request to a deployment where an internal DNS server is used to process requests for both internal and external domains. The remote network IP address is 35.1.1.1 and the
EBGP Router
IP address is 172.1.1.1. In this case, Prisma Access does not proxy the requests and, if the internal DNS server does not use NAT, the source IP of the DNS request is 10.1.1.1 (the IP address of Client 1’s device in the remote network site).
If Prisma Access proxies the DNS request, the source IP addresses of the proxied DNS requests changes to the
EBGP Router Address
for internal requests and the Service IP Address of the remote network connection for external requests, as shown in the following figure.
When you configure the DNS address in your network to use for Prisma Access proxied external requests, specify the
Remote Network DNS Proxy IP Address
(
Panorama
Cloud Services
Status
Service Infrastructure
Remote Network DNS Proxy IP Address
). In the following example, you would specify 172.1.255.254 in your network for the DNS server.

Recommended For You