Strange DNS issue for users

[a.jones]

Hi All,

Any idea on this one?

I have some wireless testing underway which seemed to be going without issue. All of a sudden, any browsing to .co.uk domains stopped working, followed by .com domains failing as well. A short while ago, .co.uk domains started working again but sporadically. If I change the rule permitting the dns traffic from either application dns or service udp 53 to anything for application default the issue resolves itself. Logs show the dns requests passing through the firewall without issue.

Has anyone seen this before?

Regards

Adrian

[BPry]

@a.jones,

Insure that you have logging enabled on the interzone-default policy so that you are getting the denied traffic. The way you describe the issue something is getting dropped and the likely cause of that is the security rulebase itself. You might also want to look at your threat logs to ensure the DNS requests aren't being dropped due to a threat identification. 

[MP18]

I agree with BPry please check the threat logs you will find the answer there.

[MP18]

Also check the traffic logs there might be some traffic blocked when you use the application default