topic Re: DNS Reverse traffic is getting dropped in General Topics

DNS Reverse traffic is getting dropped

Blason_R — Thu, 04 Jun 2020 10:04:01 GMT

Hi,

This is checkpoint clusterXL in load sharing mode and its still on R77.30. We have our NS servers configured behind firewall, however recently we started observing lot of SERVFAIL messages on DNS server and hence started troubleshooting. Eventually when we done fw ctl zdebug drop we found that server when sending Recusrsive queries to Root Hint server the response is getting dropped on Stealth rule.

Surprisingly why it would drop response from Root Hint servers. Now there are not blades running on firewall but only fw. No IPS/AMW nothing.

Here are the logs - and a.b.c.d is my Natted Public IP of my DNS server. Rule #47 is a stealth rule

4Jun2020 15:07:44.407985;[cpu_2];[fw4_1];fw_log_drop_ex: Packet proto=17 103.204.163.83:48073 -> a.b.c.d:53 dropped by fw_handle_first_packet Reason: Rulebase drop - rule 47;
4Jun2020 15:07:44.423727;[cpu_2];[fw4_1];fw_log_drop_ex: Packet proto=17 103.204.163.80:47955 -> a.b.c.d:53 dropped by fw_handle_first_packet Reason: Rulebase drop - rule 47;
4Jun2020 15:07:44.426534;[cpu_3];[fw4_0];fw_log_drop_ex: Packet proto=17 103.204.163.66:45982 -> a.b.c.d:53 dropped by fw_handle_first_packet Reason: Rulebase drop - rule 47;
4Jun2020 15:07:44.450732;[cpu_3];[fw4_0];fw_log_drop_ex: Packet proto=17 103.204.163.65:42568 -> a.b.c.d:53 dropped by fw_handle_first_packet Reason: Rulebase drop - rule 47;

Re: DNS Reverse traffic is getting dropped

PhoneBoy — Mon, 08 Jun 2020 03:05:49 GMT

I'd try: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92835
Note that even with IPS inactive, some of the protections under IPS are actually firewall protections.

Re: DNS Reverse traffic is getting dropped

Blason_R — Tue, 09 Jun 2020 17:42:40 GMT

Any way we figured that out and that is due to ClusterXL load sharing and wrong switch configuration.

Re: DNS Reverse traffic is getting dropped

kb1 — Tue, 09 Jun 2020 22:31:03 GMT

Hi so you are saying it was a wrongly configured switch that was causing the drops?

Re: DNS Reverse traffic is getting dropped

Blason_R — Wed, 10 Jun 2020 03:56:23 GMT

Yes this is what there network team told me. Sicne I do not have access to those switches if pretty tough to say what changes they made 😞