Case Study: The Firewall Wasn't the Problem — DNS Was

One morning, several users reported that they could no longer access an internal web application.

The first assumption from many users was:

"The firewall must be blocking the traffic."

Since the issue affected multiple users at the same time, the firewall immediately became the primary suspect.

However, before making any firewall policy changes, we followed a structured troubleshooting process.

Initial Symptoms
Users could not access the application using its hostname.
The server was still reachable by IP address.
Firewall policies showed no blocked sessions.
No recent security policy changes had been made.

At this stage, it would have been easy to modify firewall rules—but doing so could have introduced unnecessary risks.

Investigation

Instead of changing firewall policies immediately, we verified the following:

✅ Firewall traffic logs

✅ Security policy hit counts

✅ NAT configuration

✅ Routing

Everything looked normal.

The next step was to test DNS resolution.

Running a simple nslookup quickly revealed the issue.

The DNS server was returning an outdated IP address after a recent server migration.

The firewall had been forwarding traffic correctly all along.

Root Cause

The issue was caused by stale DNS records, not by the firewall.

Users attempting to connect via hostname were directed to an old IP address, while direct access using the correct IP worked without any issues.

Resolution

The following actions resolved the problem:

Updated the DNS record with the correct IP address.
Cleared the DNS cache on affected clients.
Verified DNS replication across all DNS servers.
Confirmed that users could successfully access the application.

No firewall policy changes were required.

Lessons Learned

One of the biggest lessons from this incident is that the firewall often becomes the first component to be blamed—even when it is functioning correctly.

Before modifying any security policy, always verify:

DNS resolution
Network connectivity
Routing
Firewall logs
Server availability

A structured troubleshooting approach not only saves time but also helps avoid unnecessary configuration changes.

Sometimes, the fastest solution is not changing the firewall at all—it's identifying the real root cause.

Thanks to share!