Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Kaspars_Zibarts
Employee Employee
Employee
Jump to solution

Domain objects in R80.10 spamming DNS

Just wondering if anyone else has noticed if you are using domain objects (new type)

I noticed high amount of Block / Alert logs on the gateway complaining it was not able to resolve DNS even though DNS is responding OK. 

When I run tcpdump I noticed that firewall sends DNS requests for each domain object in big batches (multiple requests for the same name within 100ms). So there are hundreds of DNS requests spat out every 30 secs for 20 domain objects so I'm not surprised if some are not answered.

I have not raised SR yet - just wondering if it's "known" issue? We are on take 121.

There is one SK that matches symptoms but that should have been fixed in take 42

"Firewall - Domain resolving error. Check DNS configuration on the gateway." log for blocked HTTP tr... 

1 Solution

Accepted Solutions
Meital_Natanson
Employee
Employee

Hi,

This is a known issue, solved in R80.10 JHF T142.

It will happen when using large amount of domain objects in policy.

Please contact support (& CFG) if you need the fix on top of earlier JHF take.

Thanks,

Meital

View solution in original post

9 Replies
_Val_
Admin
Admin

Hi, it seems RAD cache is not okay. Please do open a support ticket for proper diagnostics

0 Kudos
G_W_Albrecht
Legend
Legend

Are you using None-FQDN mode (sk120633) ?

CCSE CCTE CCSM SMB Specialist
0 Kudos
Kaspars_Zibarts
Employee Employee
Employee

It's the R80.10 FQDN type objects. Using old makes no sense Smiley Happy

0 Kudos
G_W_Albrecht
Legend
Legend

I second that 😉

CCSE CCTE CCSM SMB Specialist
Kaspars_Zibarts
Employee Employee
Employee

SR is still under investigation but someone else is bored, you may check if your gateway is sending malformed truncated DNS requests using TCP - has all domain objects included multiple times but most importantly packet format is wrong. Our DNS just replies as malformed packet, no results. Seems to match Blocked traffic in logs

0 Kudos
Meital_Natanson
Employee
Employee

Hi,

This is a known issue, solved in R80.10 JHF T142.

It will happen when using large amount of domain objects in policy.

Please contact support (& CFG) if you need the fix on top of earlier JHF take.

Thanks,

Meital

Kaspars_Zibarts
Employee Employee
Employee

Thanks heaps Meital! Strangely enough case engineer just asked me for more debugs and logs instead of suggesting this...

0 Kudos
Kaspars_Zibarts
Employee Employee
Employee

Haha - I didn't realise that you were from R&D .. Just had a call from case engineer. All good - we'll try one cluster in next couple of days! Thanks again!

Kaspars_Zibarts
Employee Employee
Employee

One last update - finally we rolled out take 142 last night in production: 2 VSX clusters and one non-VSX. All looking great so far, all block logs gone!

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events