DNS Resolution for Mobile Users—GlobalProtect and Remote Network Deployments
Focus
Focus
Prisma Access

DNS Resolution for Mobile Users—GlobalProtect and Remote Network Deployments

Table of Contents

DNS Resolution for Mobile Users—GlobalProtect and Remote Network Deployments

Shows the possible configurations you can use for Prisma Access to resolve DNS queries for mobile users and remote networks.
Where Can I Use This?What Do I Need?
  • Prisma Access (Managed by Strata Cloud Manager)
  • Prisma Access (Managed by Panorama)
  • Prisma Access license version 2.2 Preferred and later
  • Native IPv6 access to public and private apps requires the following minimum releases:
    • Prisma Access (Managed by Strata Cloud Manager): June 2024 release
    • Prisma Access (Managed by Panorama): Prisma Access 5.1.1 for new deployments only.
    Any other deployments (including existing Prisma Access (Managed by Panorama) deployments) support private app access only.
Prisma Access allows you to specify DNS servers to resolve both domains that are internal to your organization and external domains. Prisma Access proxies the DNS request based on the configuration of your DNS servers. The following table shows the supported DNS resolution methods for internal and external domains and indicates when Prisma Access proxies the DNS requests.
Internal DNS Resolution MethodExternal DNS Resolution MethodPrisma Access Proxies the DNS Request (Yes/No)
Single rule, DNS server configured for Internal DomainsCloud Default (Google Public DNS64 for IPv6)Yes
Single rule, DNS server configured for Internal DomainsSame as Internal DomainsNo
Single rule, DNS server configured for Internal DomainsCustom DNS server (Google Public DNS64 for IPv6)Yes
Single rule, Cloud Default set for a domainCloud Default (Google Public DNS64 for IPv6)Yes
Single rule, Cloud Default set for a domainSame as Internal Domains (Google Public DNS64 for IPv6)Yes
Single rule, Cloud Default set for domainCustom DNS server (Google Public DNS64 for IPv6)Yes
Multiple rules, DNS server configured for Internal DomainsCloud Default (Google Public DNS64 for IPv6)Yes
Multiple rules, DNS server configured for Internal DomainsSame as Internal DomainsYes
Multiple rules, DNS server configured for Internal DomainsCustom DNS server (Google Public DNS64 for IPv6)Yes
No configurationCustom DNS Server (Google Public DNS64 for IPv6)Yes
No configurationCloud Default (For IPv6, Primary = Google Public DNS64, Secondary = Cloud Default)No
No configurationNo configuration No
No DNS resolution specified (default configuration is present, which uses Cloud Default)No DNS resolution specifiedNo
ZTNA Connector (regardless of DNS resolution method)N/AYes
After you enable ZTNA Connector, Prisma Access proxies all DNS requests using the DNS rules set up for Remote Networks and Mobile Users—GlobalProtect.
The source IP address of the DNS request depends on whether or not Prisma Access proxies the DNS request.
  • When Prisma Access does not proxy the DNS requests, the source IP address of the DNS request changes to the IP address of the device that requested the DNS lookup. This source IP address allows you to enforce source IP address-based DNS policies or identify endpoints that communicate with malicious domains. This behavior applies for both mobile users and remote network deployments.
  • When Prisma Access proxies the DNS requests, the source IP address of the DNS request changes to the following addresses:
    • Mobile User deployments—The source IP address of the DNS request is an IP address taken from the mobile user IP address pool for internal requests and the mobile user location’s gateway IP address for external requests.
    • Remote Network deployments—The source IP address of the DNS request is the EBGP Router Address for internal requests and the Service IP Address of the remote network connection for external requests.
The following guidelines and restrictions apply to using DNS resolution with Prisma Access:
  • The maximum number of concurrent pending TCP DNS requests ( Max Pending Requests) that Prisma Access supports is 64.
  • For UDP queries, the DNS proxy sends another request if it hasn’t received a response in 2 seconds, and retries a maximum of 5 times before trying the next DNS server.
  • Prisma Access caches the DNS entries with a time-to-live (TTL) value of 300 seconds. EDNS responses are also cached.