topic Domain objects in R80.10 spamming DNS in General Topics

Domain objects in R80.10 spamming DNS

Kaspars_Zibarts — Thu, 16 Aug 2018 09:03:32 GMT

Just wondering if anyone else has noticed if you are using domain objects (new type)

I noticed high amount of Block / Alert logs on the gateway complaining it was not able to resolve DNS even though DNS is responding OK.

When I run tcpdump I noticed that firewall sends DNS requests for each domain object in big batches (multiple requests for the same name within 100ms). So there are hundreds of DNS requests spat out every 30 secs for 20 domain objects so I'm not surprised if some are not answered.

I have not raised SR yet - just wondering if it's "known" issue? We are on take 121.

There is one SK that matches symptoms but that should have been fixed in take 42

"Firewall - Domain resolving error. Check DNS configuration on the gateway." log for blocked HTTP traffic although relev…

Re: Domain objects in R80.10 spamming DNS

_Val_ — Thu, 16 Aug 2018 09:40:09 GMT

Hi, it seems RAD cache is not okay. Please do open a support ticket for proper diagnostics

Re: Domain objects in R80.10 spamming DNS

G_W_Albrecht — Thu, 16 Aug 2018 09:59:45 GMT

Are you using None-FQDN mode (sk120633) ?

Re: Domain objects in R80.10 spamming DNS

Kaspars_Zibarts — Thu, 16 Aug 2018 10:37:20 GMT

It's the R80.10 FQDN type objects. Using old makes no sense

Re: Domain objects in R80.10 spamming DNS

G_W_Albrecht — Thu, 16 Aug 2018 10:42:56 GMT

I second that 😉

Re: Domain objects in R80.10 spamming DNS

Kaspars_Zibarts — Fri, 17 Aug 2018 12:55:41 GMT

SR is still under investigation but someone else is bored, you may check if your gateway is sending malformed truncated DNS requests using TCP - has all domain objects included multiple times but most importantly packet format is wrong. Our DNS just replies as malformed packet, no results. Seems to match Blocked traffic in logs

Re: Domain objects in R80.10 spamming DNS

Meital_Natanson — Thu, 30 Aug 2018 13:07:19 GMT

Hi,

This is a known issue, solved in R80.10 JHF T142.

It will happen when using large amount of domain objects in policy.

Please contact support (& CFG) if you need the fix on top of earlier JHF take.

Thanks,

Meital

Re: Domain objects in R80.10 spamming DNS

Kaspars_Zibarts — Thu, 30 Aug 2018 13:13:37 GMT

Thanks heaps Meital! Strangely enough case engineer just asked me for more debugs and logs instead of suggesting this...

Re: Domain objects in R80.10 spamming DNS

Kaspars_Zibarts — Thu, 30 Aug 2018 13:21:21 GMT

Haha - I didn't realise that you were from R&D .. Just had a call from case engineer. All good - we'll try one cluster in next couple of days! Thanks again!

Re: Domain objects in R80.10 spamming DNS

Kaspars_Zibarts — Wed, 05 Sep 2018 10:58:25 GMT

One last update - finally we rolled out take 142 last night in production: 2 VSX clusters and one non-VSX. All looking great so far, all block logs gone!