topic Re: cluster xl 80.40 - trouble with external dns querys in General Topics

cluster xl 80.40 - trouble with external dns querys

Florian_Maier — Thu, 05 Mar 2020 14:50:27 GMT

Hi i have upgraded a Cluster XL to 80.40

this cluster works only as firewall (NGTP or NGTX isn't active)

in the smartconsole is all green.

dns query from internal to external doesn't work when secure xl is enabled.

if i disable secure xl the dns querys are working.

have anyone the same problem?

how can i solve this? (have to wait for a new hotfix?)

thanx all, regards

flo

Re: cluster xl 80.40 - trouble with external dns querys

PhoneBoy — Sun, 08 Mar 2020 01:18:53 GMT

If disabling SecureXL "solves" a problem, it's a bug.
Open a TAC case, please.

Re: cluster xl 80.40 - trouble with external dns querys

HeikoAnkenbrand — Sun, 08 Mar 2020 17:34:25 GMT

I had the same problem. But there is a solution to bypass the DNS server IP. You can bypass SecureXL (green flow in the picture) as described. This will use the F2F path instead of the acceleration path.

How to disable SecureXL for specific IP addresses? Edit the relevant table.def file, define the DNS Server IP addresses, whose traffic should not be accelerated. You can find more on this topic in this sk104468.

More read here:
- R80.x - Performance Tuning Tip - Control SecureXL / CoreXL Paths
- R80.x - Security Gateway Architecture (Logical Packet Flow)

Re: cluster xl 80.40 - trouble with external dns querys

PhoneBoy — Mon, 09 Mar 2020 00:34:57 GMT

Obviously that's a workaround, but we should find out why we need to disable SecureXL for this.

Re: cluster xl 80.40 - trouble with external dns querys

chris_denham — Thu, 12 Mar 2020 02:07:54 GMT

Experiencing the same issue after upgrading a Cluster to R80.40.

Interestingly the DNS traffic goes through 2 x Clusters and the issue goes away after disabling SecureXL on one of them.

We are using a bind DNS server, same issue using forwarders or root hints.

Looks like the DNS reply packet is sent twice on the egress interface from the gateway, but is never visible in a tcpdump on the DNS server itself.

Re: cluster xl 80.40 - trouble with external dns querys

chris_denham — Thu, 12 Mar 2020 03:07:32 GMT

Also managed to get this working by enabling the IPS blade (previously had firewall + IA + Mobile access only).

fwaccel conns now shows the inbound and outbound connections with the 'S' flag (PXL enabled).

Re: cluster xl 80.40 - trouble with external dns querys

Florian_Maier — Thu, 26 Mar 2020 15:57:39 GMT

@chris_denham

works

but it's only a workaround.

any updates?

regards