Introduction
The Domain Name System (DNS) is one of the most critical services in any network. A Palo Alto Networks firewall relies on DNS to resolve hostnames for various management and security functions, including software updates, dynamic content updates, URL filtering, WildFire, DNS Security, FQDN address objects, logging, and cloud-based services.
Without proper DNS configuration, the firewall may fail to connect to Palo Alto Networks cloud services, download updates, or resolve Fully Qualified Domain Names (FQDNs) used in security policies.
Why DNS Configuration is Important
A properly configured DNS server enables the firewall to:
- Download PAN-OS software updates
- Retrieve Antivirus, Applications, Threat, and WildFire updates
- Resolve FQDN Address Objects
If DNS is not configured correctly, many of these services may stop functioning.
Prerequisites
Before configuring DNS, ensure the following requirements are met:
- Administrative access to the firewall
- Management Interface configured with an IP address
- Default Gateway configured
- Connectivity to the DNS server
- Internet access (if using public DNS)
- Internal DNS server reachable (if using private DNS)
Configure DNS Using the Web Interface
Step 1: Log in to the Firewall
Open a web browser and access the firewall management interface.
Log in using an administrator account.
Step 2: Navigate to DNS Settings
Go to:
Device → Setup → Services
Locate the DNS Settings section.
Step 3: Configure the DNS Servers
Click Services and enter the DNS server information.
Example:
| Setting | Value |
| Primary DNS | 8.8.8.8 |
| Secondary DNS | 8.8.4.4 |
Alternatively, specify your organization’s internal DNS servers.
Example:
Primary DNS
- 192.168.1.10
Secondary DNS
- 192.168.1.11
Step 4: Save the Configuration
Click:
- OK
Step 5: Commit the Changes
Click Commit in the upper-right corner.
Wait until the commit process completes successfully.
Configure DNS Using the CLI
Enter configuration mode.
configure
Configure the primary DNS server.
set deviceconfig system dns-setting servers primary 8.8.8.8
Configure the secondary DNS server.
set deviceconfig system dns-setting servers secondary 8.8.4.4
Commit the configuration.
commit
Exit configuration mode.
exit
Verify the DNS Configuration
To display the configured DNS servers:
show system setting dns
Test DNS Resolution
- ping host www.google.com
If DNS is working correctly, the hostname will resolve to an IP address.
You can also verify connectivity by checking for available software updates.
request system software check
If the firewall successfully contacts the update server, DNS is functioning correctly.
Leave a Reply