DNS Resolution Issue for Spoke Firewalls over MPLS (Using External IP Instead of Internal)

[sandeepsutar]

Hi Team,

We have a hub-and-spoke MPLS setup where:

• DNS server is located at the hub site
• Spoke locations connect via MPLS
• DNS server is configured to allow queries only from internal network ranges

🔹 Issue:

Spoke Check Point firewalls (Gaia& SMBmodels) are unable to resolve DNS for updates (IPS, AV, URL Filtering, etc.).

On investigation:

• Firewalls are sending DNS queries using their MPLS WAN (external) IP
• DNS server blocks these requests since only internal IP ranges are allowed
• As a result, update services are failing

🔹 Constraints:

1. At spoke, Only two interfaces are in use (Internal + External)
2. Management interface is not currently used
3. We want to avoid NAT configuration

---

🔹 Questions:

1. Why does the firewall use the external interface IP for DNS queries instead of internal, is there a way to make it initiate using internal interface ip?
2. In Gaia, there is an option:
   • Network Management → Network Interfaces → Management Interface
   • What exactly does this control?
   • If we assign the internal interface as the management interface, will DNS queries originate from the internal IP?
3. This option is not available on SMB:
   • Is there an alternative way to control DNS source IP on SMB devices?
4. What is the recommended approach in such MPLS deployments?

---

🔹 Goal:

Ensure firewall-originated DNS queries use internal IP, so they are allowed by the DNS server.

Regards,

@emmap 

---

Any guidance or best practices would be appreciated.

[CheckPointerXL]

i think you are asking sonething that it would trigger local antispoofing

probably only nat is the solution

[Chris_Atkinson]

Source address is based on routing, it will take the interface address nearest to the destination.

MPLS with external IPs would be considered unusual here given IPv4 conservation efforts.

[PhoneBoy]

By default, traffic originating from the gateway itself uses the source address of the egress interface per the routing table.
SMB appliances do have an option to use the internal IP per sk119415.
Not aware of how to achieve this on non-SMB devices.