FirewallDNS
    Enterprise Firewalls

    How to Change DNS on Palo Alto Networks (PAN-OS)

    By [FILL IN], [FILL IN] · Last updated

    Set FirewallDNS as the upstream for the PAN-OS DNS proxy and for the management plane.

    Before you start

    You need a FirewallDNS account (see pricing). Sign in to your dashboard, register your public IP address and copy your DNS server addresses. Replace <FIREWALLDNS-PRIMARY> and <FIREWALLDNS-SECONDARY> below with them.

    Step by step

    1. Device > Setup > Services > Services: set Primary DNS to <FIREWALLDNS-PRIMARY> and Secondary to <FIREWALLDNS-SECONDARY>.
    2. Network > DNS Proxy > Add: choose the LAN interface(s) and set Primary <FIREWALLDNS-PRIMARY> and Secondary <FIREWALLDNS-SECONDARY> under Default.
    3. Network > DHCP > your interface > Options: set DNS to the firewall interface IP (or inherit from the DNS proxy).
    4. Add a Security policy denying application "dns" from trust to untrust except from the firewall itself.
    5. Commit.

    PAN-OS CLI (configure mode)

    set deviceconfig system dns-setting servers primary <FIREWALLDNS-PRIMARY> secondary <FIREWALLDNS-SECONDARY>
commit

    Verify it works

    1. Renew DHCP on a client (Windows: ipconfig /renew, macOS: reconnect Wi-Fi).
    2. Run nslookup example.com and check which server answered.
    3. Open the live log in your dashboard. New lookups should appear within seconds.

    Learn more

    Not protected yet?

    FirewallDNS costs $2.90 per device per month.