DNS rewrite matching wrong NAT rule

[william.dolbow]

Think this needs a case.  Open to any suggested workarounds.

Connecting two overlapping networks with NAT.  (why? we have to)

192.168.1.0  (zone1) --  PA --  (zone2)  192.168.1.0

policy routing in place, come in zone1 interface go out zone2 and vice versa

Doing network nats at a /24 in this example

If I do two rules, natting the overlapping network to the same - ie symmetrical nat -  DNS rewrite works: 

src: 192.168.1.0/24 to 10.1.1.0 (zone2) - dest: 10.1.1.0/24 to 192.168.1.0/24 DNS rewrite - reverse

src: 192.168.1.0/24 to 10.1.1.0 (zone1) - dest: 10.1.1.0/24 to 192.168.1.0/24 DNS rewrite - reverse

both networks will 10.1.1.0 towards the firewall - firewall has policy routes.

All is good, dns requests get fixed up in either direction correctly.

traffic passes correctly

If I nat to a different network in each direction, then only the first hit matches, its as if the DNS rewrite is matching on first ip address match only and ignoring the zone.   This fails to match on direction, and returns the wrong DNS rewrite entry for the second rule

src: 192.168.1.0/24 to 10.1.1.0 (zone2) - dest: 10.1.2.0/24 to 192.168.1.0/24 DNS rewrite - reverse

src: 192.168.1.0/24 to 10.1.2.0 (zone1) - dest: 10.1.1.0/24 to 192.168.1.0/24 DNS rewrite - reverse

zone1 network has a 10.1.1.0/24 route towards firewall

zone2 network has a 10.1.2.0/24 route towards the firewall

firewall runs policy routing

in this example, a server in Zone1 does a DNS request to a NS in Zone2, the response is correctly rewritten to 10.1.1.x

But in the other direction, the DNS answer should be 10.1.2.x but its getting matched on the NAT rule in the wrong direction

If I flip the order of the rules, the problem is that only the first destination nat is matching dns rewrite even though direction is wrong

Anyone else have this issue or know of a workaround - or why dns rewrite is not matching with zone context?

[william.dolbow]

We are running 9.0.4

And

In the second scenario where the DNS rewrite does not work, the traffic passes fine.  It just that the NAT rules are smart enough to have zone context and it appears the DNS rewrite does not.