GRE tunnel and DNS.

[Andrew_Larrick]

Hello All,   recently ran into a strange issue with a GRE tunnel and DNS.

We have an R81.10 cluster building a GRE tunnel to a VSX virtual system.  The GRE tunnel itself appears to be working fine.   We can ping across the tunnel and even get to websites ( http and https ) through the tunnel if we use the sites IP address.  DNS however......

Our firewall logs show that all the GRE traffic from the cluster to the VSX GRE peer is being nat'd to the cluster VIP.    However, a TCPdump on the interface facing the peer shows that DNS traffic is not being translated to the VIP address, yet everything else is.   Since it's not NATing to the Cluster VIP, the peer is trashing it.   

We have tried to add a manual NAT rule, but that doesn't have an effect either.  We have even translated the port to something else and with a rule on the peer to translate it back, but it still sends as the cluster members real IP.

Any thoughts as to why it's treating DNS differently?  Any ideas how to fix it?

TIA

Drew

[PhoneBoy]

Sounds like you need a TAC case here: https://help.checkpopint.com 

[the_rock]

Just curious, NAT rule you mention was added, do you even see any hits on it at all?