topic Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40? in General Topics

Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

Jerry — Sun, 19 Apr 2020 12:55:41 GMT

sk120558 does not apply - just FYI

problem is as self-explained by the screenshot. please have a look.

it is all fresh R80.40 all-in-one dual-stack infrastructure.

error is just an ALERT not BLOCK/DROP/DENY - just so you know 🙂

see the screen and tell me if you find any clues as I'm struggling to find any

1. DNS resolution works on v4 /both = fwd/rev

2. DNS resolution works on v6 /rev only! wonder why ...

ps. resolution from the gateway nslookup'ing or dig'ing - dig resolves ALL - nslookup resolves v6 only REV not FWD queries!

I think I found the bug chaps! see my screenshot.

Cheers

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

PhoneBoy — Mon, 20 Apr 2020 01:22:25 GMT

Possibly but the log is related to CPMI traffic.

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

Jerry — Mon, 20 Apr 2020 06:34:23 GMT

indeed! and that was my point 🙂 something isn't right. I'm debugging it myself today and will post update once know more. I'll share if find anything otherwise I'll rise SR with TAC as I'm in a believe that sg resolves all names just fine but struggle with ND (ipv6) fwd resolver daemon / dameon 😛

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

G_W_Albrecht — Mon, 20 Apr 2020 11:08:07 GMT

Exactly the same issue can be found on our customers 5400 R80.40 JT 25 GWs - we have SR#6-0001976805 open for it now...

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

Jerry — Mon, 20 Apr 2020 11:24:22 GMT

awesome news! Thanks. Please let me know should the resolution be found by TAC. I'm keen to have this fixed on my 13500 and 14600 devices running same OS like the one you've mentioned.

Cheers

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

G_W_Albrecht — Mon, 20 Apr 2020 11:43:04 GMT

I have pointed CP to this CheckMates topic - but i would assume someone in the R80.40 team does know of this bug already... Does it show to be cosmetic only in your case ?

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

Jerry — Mon, 20 Apr 2020 11:52:26 GMT

it is indeed sort of cosmetic as it generates an ALERT not DROP by the rules however it claims that dns resolver is not working as it should so I'd have assume it is a serious flaw I guess? Cheers.

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

Ilya_Yusupov — Tue, 21 Apr 2020 06:32:04 GMT

Hi @Jerry ,

i saw same in the past while the issue was that TCP DNS was not hit by implied rule and we didn't have explicit TCP DNS rule to allow it.

can you please check if TCP DNS is allowed by your RB?

Thanks,

Ilya

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

Jerry — Tue, 21 Apr 2020 06:49:08 GMT

@Ilyya

Thanks for the tip, I do appreciate that a lot, however I need to make you aware that R80.40 has no UDP/TCP 53 allowed by Implied rules whatsoever, you can "Configure it" but this isn't recommended afaik 😉

Reg. tcp/53 my SG is allowed to query via both proto's and port 53 its local dns server and that works but somehow it does not work on multi-stack environment when you query dns by either protocol fwd or rev dns questions ie.
when you query fqdn v6 - you have no answer, when you query fqdn v4 - you do have full answer, when you query IP v6 - you have rev dns answer same for IPv4. sam you do on other dev's on the network and there is no issue.

Should you want to t-shoot that with me I'd be more than happy to help and show you all around 🙂

Cheers!

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

Ilya_Yusupov — Tue, 21 Apr 2020 06:51:28 GMT

Thanks @Jerry , i will contact you offline to schedule remote.

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

Jerry — Tue, 21 Apr 2020 06:52:10 GMT

I'll show you example here, just bear with me, this may clarify the issue hold on.

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

Jerry — Tue, 21 Apr 2020 06:57:27 GMT

Expert@cp:0]# nslookup X.ipv6.domain.co *** HOST RESOLVES fine by other devices ***
Server: 1.2.3.4
Address: 1.2.3.4#53

*** Can't find X.ipv6.domain.co: No answer

[Expert@cp:0]# nslookup X.ipv4.domain.co
Server: 1.2.3.4
Address: 1.2.3.4#53

Name: X.ipv4.domain.co
Address: 1.2.3.4

[Expert@cp:0]#

and rev dns v4:

[Expert@cp:0]# nslookup 1.2.3.5
Server: 1.2.3.5
Address: 1.2.3.5 #53

5.3.2.1.in-addr.arpa name = X.ipv4.domain.co.

[Expert@cp:0]#

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

Ilya_Yusupov — Tue, 21 Apr 2020 07:04:14 GMT

Thanks @Jerry , i will take it with RnD and will back to you.

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

Jerry — Tue, 21 Apr 2020 07:11:18 GMT

Thanks!

One more thing,

my DNS servers are so called DUAL, they resolve either v4 or v6. R80.30 is doing that just fine and I can prove it anytime.
When SG is asking himself what is the fqdn or IP they answer respectively either v4 or v6 regardless which direction is that, I'll post here something here from R80.30 latest take, just bear with me. This will be a prof that same network, my own lab, same DNS server just normal working answers, Let me craft it for you here. Cheers!

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

G_W_Albrecht — Thu, 23 Apr 2020 09:04:51 GMT

Still no feedback in SR#6-0001976805 open for it - strange...

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

G_W_Albrecht — Mon, 27 Apr 2020 12:41:57 GMT

Finally an update in SR#6-0001976805 from CP:

Currently, it doesn't seem a bug but looks more as a failure with the DNS Resolver.
Please follow these steps to restart the DNS resolver:

Run the command  # killall wsdnsd

Push policy.

To confirm it is working, please verify the 3 kernel table for resolver
#fw ctl multik print_bl dns_reverse_domains_tbl
#fw ctl multik print_bl dns_reverse_cache_tbl
#fw ctl multik print_bl dns_reverse_unmatched_cache

In case the restart will not solve the alerts of the DNS, please proceed with debugs of 
the wsdnsd daemon:

Ilya_Yusupov, any comment ?

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

Jerry — Mon, 27 Apr 2020 13:22:41 GMT

got it and all works just fine, all 3 tables are full of bits so I presume all is fine and we do not need a call today Ilya? 🙂

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

Ilya_Yusupov — Mon, 27 Apr 2020 13:29:14 GMT

@G_W_Albrecht @Jerry thank you guys for the update, i will review the solution with RnD and updated.

@Jerry - if you solved the problem so no need for a remote today i will review the solution with RnD and update here.

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

Jerry — Mon, 27 Apr 2020 13:31:02 GMT

alers are still happening with the DNS issue, wonder why.
let's have that WebEx today (in 90 mins.) though. Alright?

Re: Domain resolving error. Check DNS configuration on the gateway (0) - bug in R80.40?

Ilya_Yusupov — Mon, 27 Apr 2020 13:32:28 GMT

@Jerry - no problem.