topic Re: Fqdn Refresh job failed on passive device in General Topics

Fqdn Refresh job failed on passive device

MP18 — Thu, 15 Nov 2018 16:11:22 GMT

we are getting email alert for the Fqdn Refresh job failed on passive device

does passive device need to do the fqdn refresh?

Re: Fqdn Refresh job failed on passive device

OtakarKlier — Thu, 15 Nov 2018 17:46:27 GMT

Hello,

I would say yes since if it needs to take over its up to date. Check which interface you are using for the 'Service Path', if it is not the management port, it will not be up on a passive device. Also it could be something else blocking the traffic?

Just a few thoughts.

Re: Fqdn Refresh job failed on passive device

BPry — Fri, 16 Nov 2018 22:48:53 GMT

@MP18,

As @OtakarKlier mentioned really the default answer to this question would be yes. However, depending on what you're using FQDNs for and how vital they are in your configuration, a laps of an update could potentially be a non/small issue that is acceptable for your organization. A lot of people run into this on passive devices since they aren't using the management port, and in that case I would just say that you shouldn't use any FQDN objects in vital policies.

That being said, obviously giving the device a dedicated management interface has multiple advantages outside of just allowing FQDN refreshes while passive. If at all possible, I would really recommend that the firewall management port always have a connection and you don't rely on the service routes option.