2M DNS queries per day via vpn for about 1k fqdn - 1900+ each

[chrominek]

Hi!

No user activity, no security blades, only "baby vpn". All over the clock, regardless of the user activity, over the vpn are sent dns queries. Quantum Spark 1570 Appliance  R81.10.10 (996002993)

For the last 24 hours it looks like this:

... | stats dc(query) as distinct_query_count -> 923

...

 

Counts for each FQDN are similar, around 1900. FQDNs are mixed.

Looks like not related to any user traffic (tcpdump not showing any activity nor any dns queries on the internal interfaces).

Looks like autogenerated by gateway itself - almost 2M queries/day.

Some fgdns are "grepable" in prfm2.0, some not.

Why at all, why this FQDN-s (923 for the last 24 h), why every 45s (24*3600/1900 =~45) ?

BR

Andrzej

[PhoneBoy]

What does your access policy look like?
If you're using any FQDN objects or Updatable Objects, we need to resolve those DNS domains to IP addresses, thus the gateway will need to issue DNS requests.