DNS issues

VictoriaMyatt1 — Fri, 30 Aug 2019 15:50:57 GMT

Hi All,

hoping someone could possibly shed some light on what I maybe missing in the configuration...Im going out of my mind looking at this as I just cant see it, ill try to keep it short....

I recently replaced our offsite meeting room location Juniper SRX with a PA-220:

PPPoe Setup with VDSL modem
VPN tunnel back to main office
Meraki AP to provide CORP and Guest wifi (both networks broadcast from same AP)
Internet access pushed back to main office firewall and onto proxy server for filtering (will be removing proxy servers but not yet)
DHCP configured on Interface for CORP Wifi

The above setup worked without issues on the SRX - since moving across to the PA-220 I am having issues with DNS resolution:

Able to perform NSLOOKUP to domain controller at main site and resolve
unable to resolve any hostname from CORP Wifi
Tested connecting directly to the firewall via cable and setting up test network - same issues

I am aware that a whole number of things could cause these issues so ill list what we have done/ tested/ setup

x2 layer 3 subinterfaces one for CORP wifi and one for GUEST wifi - both tagged but no VLAN's configured on the PA-220
layer 3 sub interface for CORP wifi has DHCP configured with internal DNS servers - policy created to push internet traffic from this zone across the VPN tunnel to the Proxy server for internet access - VPN tunnel is up and no issues with PPPoe network access
Layer 3 Sub interface for GUEST wifi goes straight out of the firewall for internet access
NAT rule created for GUEST wifi - this wifi access works without issues, external DNS resolutoin with no issues
Security policies created for DC Comms including DNS access - I can see traffic coming from the PA-220 and hitting the main office firewall as allowed when running nslookups and traceroutes
Clients can obtain IP addresses from the DHCP set up on CORP Wifi and have the correct internal DNS settings
When attempting to access any internal resource by DNS name it immediately fails

The more i look at it the more i know ive probably missed something but cant put my finger on what....

Any one have any ideas?

Many thanks 🙂

Re: DNS issues

OtakarKlier — Fri, 30 Aug 2019 16:44:40 GMT

Hello,

Do you have logging enabled on the default policies, Inter/Intra zone? If not enable then and check the logs for dns traffic. If your WiFi is in a different zone than you VPN tunnel (it should be), check the logs to see if its getting blocked somewhere.

Regards,

Re: DNS issues

fatboy1607 — Wed, 04 Sep 2019 11:32:05 GMT

run wireshark on PC check for DNS packet

enabled packet capture on firewall to check DNS traffic.

As mentioned check security policy between different zones.

topic Re: DNS issues in General Topics

DNS issues

Re: DNS issues

Re: DNS issues