We would like to configure SDWAN for our branch site that only has broadband internet. In order to do that we need to know from which public IP does the PAN use to initiate the SDWAN. Because the Public IP changes from time to time, We would like to use FQDN, and so we need to configure DDNS on the internet interface.

I got it semi-work using No-IP v1 and FreeDNS Afraid.org v1, but both resulted in A record with Private IP as the value because the PAN FW sitting behind NAT from broadband modem. What I want, is obviously the value would be the Public IP of SNAT from the broadband modem not the private ip of palo alto interface.

DDNS Configuration: ddnsconfig

DDNS Info: ddnsconfig2

NoIP record: enter image description here

Our environment:

  • PANOS 10.2.4

So my question,

  1. Assuming there is no other device (router/server) that can be used as DDNS client. Is it possible to use only Palo Alto NGFW as DDNS client in the situation that Palo Alto only has private IP (sitting behind NAT)?
  2. If it is, how to do it?
  • Has any answer solved your question? Then please accept it or your question will keep popping up here forever. Please also consider voting for useful answers.
    – Zac67
    Jun 6, 2023 at 20:01

1 Answer 1


Since it's the dynamic DHCP client you're using, the answer is no. Using DHCP can only see the local interface address. Since you seem to have a NAT router between the PA and WAN there's no direct way to see that address.

You'd need to ask either your WAN router or an external service for your current public address. Most likely that task is better placed on one of your servers - some scripting should take care of that (off topic here).

Alternatively, you could

  • connect the PA directly to WAN - after all it's a firewall or
  • contact your ISP to get a permanent public IP address

I'd recommend both.

  • I just find it weird that palo alto can do ddns query/api request with specific IP but can't do general ddns query without ip (if you do manual query/curl without inputting the ip, the NoIP service will automatically extract your public IP and update the ddns record, the ddns client doesn't really need to have/know their public ip), so I thought i'm missing something here May 7, 2023 at 18:45
  • I find it weird that a PA supports DDNS in that way at all.
    – Zac67
    May 8, 2023 at 6:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.