Configure Dynamic DNS for Firewall Interfaces

1. Configure DDNS.
   1. Select NetworkInterfacesEthernet and select a Layer 3 interface, subinterface, or Aggregate Ethernet (AE) interface; or select NetworkInterfacesVLAN and select an interface or subinterface.
   2. Select AdvancedDDNS and select Settings.
   3. Enable DDNS. You must initially enable DDNS to configure it. (If your DDNS configuration is unfinished, you can save it without enabling it so that you do not lose your partial configuration.)
   4. Enter the Update Interval (days), which is the number of days between updates that the firewall sends to the DDNS service to update IP addresses mapped to FQDNs (default is 1; range is 1 to 30). Choose an interval based on how frequently your IP addresses change. (The updates that the firewall sends at regular intervals are in addition to the updates the firewall sends upon receiving an address change. The updates sent at regular intervals are to ensure that updates sent per address change are not lost, for example.)
   5. Enter the Hostname for the interface, which is already registered with the DDNS service (for example, www.serverA.companyx.com or serverA).
      Make sure this hostname matches the hostname you registered with your DDNS service. You should enter an FQDN for the hostname; the firewall doesn’t validate the hostname except to confirm that the syntax uses only valid characters allowed by DNS for a domain name.
   6. Select IPv4 and select one or more IPv4 addresses assigned to the interface or Add an IPv4 address to associate with the hostname (for example, 10.1.1.1). You can select only as many IPv4 addresses as the DDNS service allows. All selected IPv4 addresses are registered with the DDNS service. Select at least one IPv4 or one IPv6 address.
   7. Select IPv6 and select one or more IPv6 addresses assigned to the interface or Add an IPv6 address to associate with the hostname. You can select only as many IPv6 addresses as the DDNS service allows. All selected IPv6 addresses are registered with the DDNS service. Select at least one IPv4 or one IPv6 address.
   8. Select or create a new certificate profile (Certificate Profile) using the imported SSL certificate from the DDNS service to verify the SSL certificate of the DDNS service when the firewall first connects to a DDNS service to register an IP address and at every update. When the firewall connects to the DDNS service to send updates, the DDNS service presents the firewall with an SSL certificate signed by the certificate authority (CA) so that the firewall can authenticate the DDNS service.
   9. Select the Vendor (and version number) you are using for DDNS service.
      Palo Alto Networks may change the supported DDNS service providers via a content update.
   10. The vendor choice determines the vendor-specific Name and Value fields below the Vendor field. Some Value fields are read-only to notify you of the parameters the firewall uses to connect to the DDNS service. Configure the remaining Value fields, such as a password that the DDNS service provides to you and a timeout that the firewall uses if it doesn’t receive an update from the DDNS service.
   11. Click OK.
2. (Optional) If you want the firewall to communicate with the DDNS service using an interface other than the management interface, configure a service route for DDNS (Set Up Network Access for External Services).
3. Commit your changes.
4. View DDNS information for the interface.
   1. Select NetworkInterfacesEthernet or NetworkInterfacesVLAN and select the interface you configured. (Interfaces with DDNS configured display the DDNS icon—
      —in the Features field.)
   2. Select AdvancedDDNS and Settings.
   3. Show Runtime Info to see the DDNS information for the interface, including the Last return code (result of the last FQDN update) and Last time (date and time) the DDNS service received an FQDN update.