DNS issues

Reply
Highlighted

DNS issues

Hi All, 

 

hoping someone could possibly shed some light on what I maybe missing in the configuration...Im going out of my mind looking at this as I just cant see it, ill try to keep it short....

 

I recently replaced our offsite meeting room location Juniper SRX with a PA-220:

  • PPPoe Setup with VDSL modem
  • VPN tunnel back to main office 
  • Meraki AP to provide CORP and Guest wifi (both networks broadcast from same AP) 
  • Internet access pushed back to main office firewall and onto proxy server for filtering (will be removing proxy servers but not yet)
  • DHCP configured on Interface for CORP Wifi

The above setup worked without issues on the SRX - since moving across to the PA-220 I am having issues with DNS resolution:

 

  • Able to perform NSLOOKUP to domain controller at main site and resolve
  • unable to resolve any hostname from CORP Wifi
  • Tested connecting directly to the firewall via cable and setting up test network - same issues 

I am aware that a whole number of things could cause these issues so ill list what we have done/ tested/ setup

 

  • x2 layer 3 subinterfaces one for CORP wifi and one for GUEST wifi - both tagged but no VLAN's configured on the PA-220
  • layer 3 sub interface for CORP wifi has DHCP configured with internal DNS servers - policy created to push internet traffic from this zone across the VPN tunnel to the Proxy server for internet access - VPN tunnel is up and no issues with PPPoe network access
  • Layer 3 Sub interface for GUEST wifi goes straight out of the firewall for internet access 
  • NAT rule created for GUEST wifi - this wifi access works without issues, external DNS resolutoin with no issues
  • Security policies created for DC Comms including DNS access - I can see traffic coming from the PA-220 and hitting the main office firewall as allowed when running nslookups and traceroutes
  • Clients can obtain IP addresses from the DHCP set up on CORP Wifi and have the correct internal DNS settings
  • When attempting to access any internal resource by DNS name it immediately fails

The more i look at it the more i know ive probably missed something but cant put my finger on what....

 

Any one have any ideas?

 

Many thanks :)

 

Tags (2)
L7 Applicator

Re: DNS issues

Hello,

Do you have logging enabled on the default policies, Inter/Intra zone? If not enable then and check the logs for dns traffic. If your WiFi is in a different zone than you VPN tunnel (it should be), check the logs to see if its getting blocked somewhere.

 

Regards,

L4 Transporter

Re: DNS issues

run wireshark on PC check for DNS packet

 

enabled packet capture on firewall to check DNS traffic.

 

As mentioned check security policy between different zones.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!