Reduce FQDN Refresh Timer on Firewall in Order to Prevent Intermittent AWS Connection Outages

89413

Created On 02/14/19 17:57 PM - Last Modified 08/17/26 15:39 PM

DNS

Device Management

8.0

PAN-OS

Symptom

AWS ECS cluster ip addresses changes causing interval outages due to the minimum 10 minute refresh timers for FQDN that can be configured on the firewall.

Environment

PAN-OS 8.0
FQDN

Cause

Before PAN-OS 9.0, the minimum value for fqdn refresh-time was 10 minutes

> configure
# set deviceconfig system fqdn-refresh-time <600-14399> (in seconds)
# commit

Resolution

Upgrade to PAN-OS 9.0 or later
From CLI configuration mode, modify the FQDN refresh timer (default: 30 secs) and verify the change

The default fqdn refresh timer is 30 secs 
> show config running | match fqdn-refresh-time
Note: when there is no value displayed, it indicates default fqdn timer is used (i.e. 30 secs).

> configure
# set deviceconfig system fqdn-refresh-time <value> <0-14399> Minimal seconds for periodic FQDN refresh
# commit
# exit

> show config running | match fqdn-refresh-time
fqdn-refresh-time 60;

Then from UI do:

Select Device >Setup >Services >Global (omit Global on a firewall without multiple virtual system capability) and edit.
Configure the FQDN timers for the firewall:
1. Select DNS Servers or DNS Proxy Object.
2. Enter the Minimum FQDN Refresh Time (sec) in seconds to limit how frequently the firewall will refresh the FQDN cache entries (range is 0 to 14,400; default is 30). A setting of 0 means the firewall will refresh the FQDN based on the TTL value in the DNS record; the firewall doesn’t enforce a minimum FQDN refresh time.
3. Enter the FQDN Stale Entry Timeout (min) in minutes, which is the length of time that the firewall continues to use stale FQDN resolutions in the event of an unreachable DNS server (range is 0 to 10,080; default is 1,440). A value of 0 means the firewall does not use a stale FQDN entry.
4. Click OK
commit

Additional Information