DNS lookup failure(s) for Palo Alto Networks


Palo Alto Networks


Indeni will alert if the DNS resolution is not working on the device.

Remediation Steps

Review the cause for the DNS resolution not working.

How does this work?

This script logs into the Palo Alto Networks firewall through SSH attempts to ping www.indeni.com. In the process of that ping, it also forces the firewall to resolve "www.indeni.com" to an IP address. A failure to ping www.indeni.com indicates that the DNS server is not responding, or that connectivity to the Internet has been severed.

Why is this important?

Some services on a Palo Alto Networks firewall require a working DNS connection. For example, the FQDN objects require DNS connectivity (see https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-and-Test-FQDN-Objects/ta-p/61903).

Without Indeni how would you find this?

An administrator would need to write a script to poll their firewalls for the data (force a resolution of a hostname), or simply troubleshoot once an issue occurs.

View Source Code