topic DNS traffic using S2S VPN is not working in Spark Firewall (SMB)

DNS traffic using S2S VPN is not working

luk89as — Wed, 19 Oct 2022 12:27:31 GMT

Good morning,

I have two checkpoint 750 and 730 devices connected to each other using VPN S2S.

IP traffic using VPN works without problem. I can access devices on the LAN from either side.

From the CP750 side, I have an Exchange Server 2019 ST server.

When Outlook is on the LAN, the CP730 cannot connect to Exchange Server 2019 because it does not send DNS queries via VPN.

How to configure the CP 750 and 730 for DNS queries to be sent over the S2S VPN tunnel.

Chris_Atkinson — Wed, 19 Oct 2022 12:41:27 GMT

There is an advanced setting which if enabled will provide the behaviour as your describing.

"Do not encrypt local DNS requests"

Worth checking before exploring elsewhere.

luk89as — Wed, 19 Oct 2022 13:06:58 GMT

In the advanced settings, I have set the following options:

Global VPN Site to Site settings - do not encrypt local DNS requests - TRUE

I set the setting as always about CP730 and CP 750.

Even so, I still don't have DNS traffic over the S2S VPN. You can see in the logs that it is encrypted.

Chris_Atkinson — Wed, 19 Oct 2022 13:54:34 GMT

The other advanced option that may apply is:

"Do not encrypt connections originating from the local gateway"

Failing this if all other VPN parameters check out and you're on the latest build of R77.20.87 I would discuss it further with TAC.

luk89as — Wed, 19 Oct 2022 13:37:03 GMT

In each of the configuration pages, for these two settings to be set to TRUE.

Screen in the appendix.

I don't know if it matters, but the S2S VPN connection is made using certificates.

Even though you select the option that it does not encrypt DNS traffic it does otherwise.

The log shows that traffic from the CP730 LAN is blocked on the CP 750 side.

Maybe a rule in the firewall needs to be created?

the_rock — Wed, 19 Oct 2022 13:44:27 GMT

Are both centrally managed? If so, check option in global properties "accept domain name over..."

luk89as — Thu, 20 Oct 2022 06:24:44 GMT

I started unencrypted DNS traffic over VPN.

In the S2S VPN settings I checked the option: "Allow traffic to the internet from remote site through this gateway."

I applied the setting to both Checkpoint devices.

PhoneBoy — Thu, 20 Oct 2022 19:40:41 GMT

Do Not Encrypt Local DNS Requests of TRUE means that DNS requests won't be encrypted (sent over VPN).
What happens when you make it FALSE?