DNS issues

[VictoriaMyatt1]

Hi All, 

hoping someone could possibly shed some light on what I maybe missing in the configuration...Im going out of my mind looking at this as I just cant see it, ill try to keep it short....

I recently replaced our offsite meeting room location Juniper SRX with a PA-220:

• PPPoe Setup with VDSL modem
• VPN tunnel back to main office 
• Meraki AP to provide CORP and Guest wifi (both networks broadcast from same AP) 
• Internet access pushed back to main office firewall and onto proxy server for filtering (will be removing proxy servers but not yet)
• DHCP configured on Interface for CORP Wifi

The above setup worked without issues on the SRX - since moving across to the PA-220 I am having issues with DNS resolution:

• Able to perform NSLOOKUP to domain controller at main site and resolve
• unable to resolve any hostname from CORP Wifi
• Tested connecting directly to the firewall via cable and setting up test network - same issues 

I am aware that a whole number of things could cause these issues so ill list what we have done/ tested/ setup

• x2 layer 3 subinterfaces one for CORP wifi and one for GUEST wifi - both tagged but no VLAN's configured on the PA-220
• layer 3 sub interface for CORP wifi has DHCP configured with internal DNS servers - policy created to push internet traffic from this zone across the VPN tunnel to the Proxy server for internet access - VPN tunnel is up and no issues with PPPoe network access
• Layer 3 Sub interface for GUEST wifi goes straight out of the firewall for internet access 
• NAT rule created for GUEST wifi - this wifi access works without issues, external DNS resolutoin with no issues
• Security policies created for DC Comms including DNS access - I can see traffic coming from the PA-220 and hitting the main office firewall as allowed when running nslookups and traceroutes
• Clients can obtain IP addresses from the DHCP set up on CORP Wifi and have the correct internal DNS settings
• When attempting to access any internal resource by DNS name it immediately fails

The more i look at it the more i know ive probably missed something but cant put my finger on what....

Any one have any ideas?

Many thanks 🙂

[OtakarKlier]

Hello,

Do you have logging enabled on the default policies, Inter/Intra zone? If not enable then and check the logs for dns traffic. If your WiFi is in a different zone than you VPN tunnel (it should be), check the logs to see if its getting blocked somewhere.

Regards,

[fatboy1607]

run wireshark on PC check for DNS packet

enabled packet capture on firewall to check DNS traffic.

As mentioned check security policy between different zones.