Harmony Connect Corporate DNS Scenario is not working in RA mode

[Blason_R]

Hi Team,

I am trying to demonstrate a below scenario with Harmony RA. I have setup my DC as 10.10.144.0/24. Customer would like to route the DNS traffic only to internal DNS server since they have secure DNS resolver. They would not want to use IA or any other applications at this moment.

Have setup two machines 10.10.144.4 as my Harmony connector and installed the docker and followed the procedure

Then customer has a secure DNS resolver 10.10.144.2.

Configured local user on Harmony portal and setup the Network access policy.

However my queries to corporate DNS server is not working. I wanted all my DNS queries should be sent to 10.10.144.2.

Here is my setup and configuration. Am I missing anything here? and have below queries 

1. Since this is Cloud setup - I need to open firewall ports between 10.10.144.4 and 10.10.144.2.
2. Do I really need to do that?
3. What IP addresses or network is being used by Harmony connect to allow in cloud?
4. Will that traffic will be tunneled as well to reach to private IP address? Or it will be sent to Public IP address of Secure Resolver?

TIA

Blason R

[Blason_R]

Hey Folks any help is here? I have been working on this troubleshooting but dang; dns queries are not passing through the tunnel to my secure resolver.

@Chris_Atkinson @G_W_Albrecht - Can you guys tag any one from Harmony team? Or involve them? I would really appreciate that

[Chris_Atkinson]

How is your Network Access policy defined?

Connectivity Mode = Network Access only?

What networks are configured in your Bypass Destinations?

Does the connector monitoring report that it is online?

[Blason_R]

Hi There,

Here are my responses - 

Access to given as source Any and destination to Network 10.10.144.0/24 to service any

Connectivity mode - Network Yes

I removed 10.0.0.0/8 from Bypass destinations

And yes connector reports online.

[Blason_R]

Unfortunately I am still not getting any response neither my scenario works!! Can somone pls help?

[Chris_Atkinson]

What does the routing tables on the client look like when HC is connected, have you investigated the other end with tcpdump or similar?

Are you in contact with your local SE about this?

[Blason_R]

The routing table absolutely looks fine and the routes are present for my encryption domain. Those appears in my desktop routing table. I tried capturing packets but I dont see those packets.

 I mean none of access works not SSH or DNS as well.

Yes I tried connecting to local SE but does not look like of much help. I myself have done the extensive troubleshooting and went through so many logs but does not look like SE will be able to help me. May be SME from Harmony connect can help?

[Chris_Atkinson]

In general your SE should be able to connect you with the relevant support teams / resources.

Is the result the same if you try a different source machine or any potential conflicts there in terms of other security software that might be installed? 

Will reach out internally to see who can assist further.

[Blason_R]

Sure Thanks - Let me see and try reaching out to local SE

[Andy_P]

Hi @Chris_Atkinson  Please contact me offline to take a look.

[ICSI]

1 Harmony Connect / Assets / Branches & Data Centers / click on the (I) symbol and have you enable your internal network here?

Internal Sub-Networks 10.10.144.0/24 for example. 

2  Harmony Connect  / Settings / Connectivity Mode : At least do you have Corporate Access Network Access enabled?

3  Harmony Connect / Settings / Harmony Connect Agent / Do you have it disabled when being inside the Corporate Office? I do and I defined a couple of IPs that confirm I am inside.

4  Harmony Connect / Settings / Corporate DNS Servers: You should be able to ping this IP from the Harmony Connect machine. I am using a Virtual Machine and I had problems when sharing the same IP, it was a small mistake. Turned to NAT and I let the VM to have its own IP.

5 Check the FW/ IPtables. I had problems with this as well.

6 and probable this should be the FIRST STEP! Are you using Ubuntu 22.04 SERVER edition? If not, please start over and use ONLY Ubuntu Server, otherwise you will have n kind of problems, as I did.

G’Luck!

[Blason_R]

Here are my responses -

1. YES

2. YES Network Connectivity

3. Nope - I dont need to since all the time I wanted my corporate DNS to be used since corporate or secure DNS to resolve the DNS queries.

4. Nope I am not able to PING

5. IPtables and all firewall is off. Checked 1000 times 🙂

6. Even I tried with 20.04 but the same thing.

Any thing else that you would want me to try?

[_Val_]

Maybe it's a good time to consider a TAC case: https://help.checkpoint.com

[Andy_P]

Hi.

Please check that you don't have network 10.0.0.0/8 in bypass configuration for HC agent. See screenshot attached. 

Harmony Connect App > setting > Harmony Connect agent > Bypass destinations.

You should also have DNS traffic allowed in Network Access  policy

[Blason_R]

Well I am inching towards resolution - so far I was able to connect to internal servers but I am still unable to forward the queries. Will share the entire solution once I am done.

[Blason_R · Accepted solution]

Finally the issue is resolved and really appreciate the help from @Andy_P for his extensive help. Much thankful to him.

The issue was - in my cloud whenever I was spinning vms it used to get two nics one with Public IP and another with my VPC.

Now when I start docker it used to get start on eth0 since it has a default gateway pointed to internet; even I started running on eth1 but docker was not coming up and it always used to show tunnel was not up.

However it used to come up properly with eth0; now since tunnel is established with Public IP it was not able to route the traffic for internal IP. Even I setup ip_forward, added iptables with masquerade but in vain.

Finally here is what I did -

Lets assume I have spin two vms VMA (Connector VM) and VMB (BIND/Named VM) with IP schema

VMA 
eth0 : 1.2.3.4
eth1: 10.10.144.4

VMB
eth0 : 5.6.7.8
eth1: 10.10.144.2

So I first deleted default route from VMA which is connector VM (of course this is done by connecting to internal IP from VMB)

Added default route through netplan and pointed to VMB {0.0.0.0/0 NH 10.10.144.2}

Enabled ip_forward on VMB

Added iptables masquerade on VM

iptables -t NAT -A POSTROUTING -s 10.10.144.0/24 -o eth0 -j MASQUERADE

That was my connector vm started routing through eth1 and to internet through VMB. Then I deleted the docker image and re-run on eth1 on VMB.

That finally worked with this. Again there is no need to deploy rule in network Access policy as I did not want any one to connect my DNS Server on port 22.

My Corporate DNS server was set to 10.10.144.2

[ICSI]

that was a really good solution! thanks for sharing. NOW WE KNOW!