topic VSX Clustering R80.20 DNS resolving error msg in Firewall and Security Management

VSX Clustering R80.20 DNS resolving error msg

jbfixurpc_cew — Thu, 24 Oct 2019 13:38:10 GMT

Greetings!

I am seeing constant Alert error messages in our logs with reason: Firewall - Domain resolving error. Check DNS configuration on the gateway (0) .

Here are the statistics: R80.20, running on VSX, JHF Take 103 applied,

Initially I thought the issue was being caused by the fact that in VSX the DNS servers for each context are the same (SK152873 - a large oversight if you ask me but) so with some redesign I was able to find 3 common DNS targets that would work in this scenario. Once that was applied, I still am seeing tons of these alert errors.

From the CLI I am able to confirm that all of the VSX contexts resolve DNS using dig/nslookup etc so I am not sure why I would be seeing this behavior

Re: VSX Clustering R80.20 DNS resolving error msg

Ilya_Yusupov — Thu, 24 Oct 2019 16:35:47 GMT

Hi,

I guess you are using domain objects, right?

Re: VSX Clustering R80.20 DNS resolving error msg

jbfixurpc_cew — Thu, 24 Oct 2019 16:41:20 GMT

As a matter of fact, yes, were trying to do that. What I am failing to understand is that from an external resource I can generate DNS traffic to a DNS server behind the cluster, and I see the error appear in that manor, sometimes... It's completely hit or miss which is confusing to say the least, sometimes I see the hits with no alerts, other times with the alert "Firewall - Domain resolving error. Check DNS configuration on the gateway (0)" which makes no sense to ,e.

Re: VSX Clustering R80.20 DNS resolving error msg

Ilya_Yusupov — Thu, 24 Oct 2019 18:34:31 GMT

We had such issue in the past which should be solved.

I will check it internaly and will update.

Re: VSX Clustering R80.20 DNS resolving error msg

Ilya_Yusupov — Sun, 27 Oct 2019 10:13:26 GMT

Hi,

the fix included in on going JHF take 117, if you can move to this take it will be great.

if not i suggest to open a ticket for CP support to ask a port fix.

Thanks,

Ilya

Re: VSX Clustering R80.20 DNS resolving error msg

Khalid_Aftas — Wed, 15 Jan 2020 10:58:04 GMT

Hi Ilya,

We have same issue on r80.30 HF take 111, can you check internaly if that fix was ported to r80.30 ?

Re: VSX Clustering R80.20 DNS resolving error msg

Ilya_Yusupov — Wed, 15 Jan 2020 11:44:06 GMT

Hi Khalid,

The fix already included in R80.30 GA version so i suggest to open a TAC case and share it with me so i can check with RnD owners.

Re: VSX Clustering R80.20 DNS resolving error msg

Kaspars_Zibarts — Sat, 25 Jan 2020 12:55:23 GMT

Probably you have resolved it by now but if not make sure that TCP DNS lookups are allowed from your gateway

https://community.checkpoint.com/t5/General-Management-Topics/Domain-Objects-FQDN-An-Unofficial-ATRG/m-p/72958#M10845