VSX Clustering R80.20 DNS resolving error msg

[jbfixurpc_cew]

Greetings!

I am seeing constant Alert error messages in our logs with reason: Firewall - Domain resolving error. Check DNS configuration on the gateway (0) .

Here are the statistics: R80.20, running on VSX, JHF Take 103 applied, 

Initially I thought the issue was being caused by the fact that in VSX the DNS servers for each context are the same (SK152873 - a large oversight if you ask me but) so with some redesign I was able to find 3 common DNS targets that would work in this scenario. Once that was applied, I still am seeing tons of these alert errors.

From the CLI I am able to confirm that all of the VSX contexts resolve DNS using dig/nslookup etc so I am not sure why I would be seeing this behavior 

[Ilya_Yusupov]

Hi,

I guess you are using domain objects, right?

[jbfixurpc_cew]

As a matter of fact, yes, were trying to do that. What I am failing to understand is that from an external resource I can generate DNS traffic to a DNS server behind the cluster, and I see the error appear in that manor, sometimes... It's completely hit or miss which is confusing to say the least, sometimes I see the hits with no alerts, other times with the alert "Firewall - Domain resolving error. Check DNS configuration on the gateway (0)" which makes no sense to ,e.

[Ilya_Yusupov]

We had such issue in the past which should be solved.

I will check it internaly and will update.

[Ilya_Yusupov]

Hi,

the fix included in on going JHF take 117, if you can move to this take it will be great.

if not i suggest to open a ticket for CP support to ask a port fix.

Thanks,

Ilya 

[Khalid_Aftas]

Hi Ilya,

We have same issue on r80.30 HF take 111, can you check internaly if that fix was ported to r80.30 ?

[Ilya_Yusupov]

Hi Khalid,

The fix already included in R80.30 GA version so i suggest to open a TAC case and share it with me so i can check with RnD owners.

[Kaspars_Zibarts]

Probably you have resolved it by now but if not make sure that TCP DNS lookups are allowed from your gateway

https://community.checkpoint.com/t5/General-Management-Topics/Domain-Objects-FQDN-An-Unofficial-ATRG...