使用加载均衡器时用户DNS代理查询失败

使用加载均衡器时用户DNS代理查询失败

1992
Created On 08/15/24 03:06 AM - Last Modified 10/15/25 17:26 PM


Symptom


  • 用户尝试通过DNS代理查询域时遇到错误
  • 以下日志表明在启用调试的 DNS 代理日志中未启用 EDNS:
2024-08-07 12:35:46.438 -0400 debug: pan_dnsproxyd_recv_dp_udp_cb(pan_dnsproxy_udp.c:290): [udp]: fd 20 from 10.65.177.26 to 10.65.22.9 recv len 43.
2024-08-07 12:35:46.438 -0400 debug: pan_dnsproxy_process_client_pkt(pan_dnsproxy_pkt.c:1848): [-/6426/0/-]: DNS request received on IP:10.65.22.9.
2024-08-07 12:35:46.438 -0400 debug: pan_dnsproxy_get_rt_by_addr(pan_dnsproxy_pkt.c:105): Found rt_obj:0x562285e46000 in ip/ipv6_obj_hash tbl
2024-08-07 12:35:46.438 -0400 debug: pan_dnsproxy_process_client_pkt(pan_dnsproxy_pkt.c:1884): [-/6426/0/-]: use dnsproxy_rt:0x562285e46000, name:dp_kop_vpn.
2024-08-07 12:35:46.438 -0400 debug: unbound_parse_dns_header(utils_unbound/pan/unbound_api.c:847): ========== In: unbound_parse_dns_header ==========
2024-08-07 12:35:46.438 -0400 debug: unbound_parse_dns_header(utils_unbound/pan/unbound_api.c:874): tran. ID: 6426
qdcount: 1
ancount: 0
nscount: 0
arcount: 0
2024-08-07 12:35:46.438 -0400 debug: unbound_pkt_parse_request(utils_unbound/pan/unbound_api.c:1023): ========== In: unbound_pkt_parse_request ==========
2024-08-07 12:35:46.438 -0400 debug: query_info_parse(utils_unbound/libs/msgreply.c:73): ========== In: query_info_parse ==========
2024-08-07 12:35:46.438 -0400 debug: unbound_pkt_parse_request(utils_unbound/pan/unbound_api.c:1056): qname: _ldap_tcpcslg1cslgnet qtype: 33 qclass: 1
2024-08-07 12:35:46.438 -0400 debug: parse_edns_from_pkt(utils_unbound/libs/msgparse.c:87): ========== In: parse_edns_from_pkt ==========
2024-08-07 12:35:46.438 -0400 debug: unbound_pkt_parse_request(utils_unbound/pan/unbound_api.c:1121): EDNS NOT enabled, UDP size: 512
2024-08-07 12:35:46.438 -0400 debug: pan_dnsproxy_process_client_pkt(pan_dnsproxy_pkt.c:1910): [dp_kop_vpn/6426/0/-]: query V_ldap._tcp.cslg1.cslg.net.


Environment


  • 帕诺斯-11.1.1
  • PA-5260
  • GP-6.0.4
  • 已启用DNS代理配置


Cause


  • DNS代理下未启用高级TCP选项


Resolution


  1. 要解决此问题,客户必须导航至网络 > DNS代理 > [选择代理] > 高级 > 选中 [TCP查询] 复选框


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000scfKCAQ&lang=zh_CN&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language