This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNS Request Route doesn't work when H.A auxiliary becames primary

Hi guys,

I have a problem in my network, I have two firewalls in H.A, in the primary I made several DNS records in DNS Request Route and they work well the primary, but when the auxiliary becomes the primary the DNS Request Route stops working. Do you have any DNS Request Route limitations for H.A?

Can you help me?

Thanks

This thread was automatically locked due to age.

Parents

0 LuCar Toni over 4 years ago

Do you use V17.5 MR8 / 9 ?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Luana Farias over 4 years ago in reply to LuCar Toni

V17.5 MR9
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 4 years ago in reply to Luana Farias

Is the DNS request route in any case "special"? Lets say behind a IPsec Tunnel or direct attached to one Interface?

How can the XG reach the DNS Server?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Luana Farias over 4 years ago in reply to LuCar Toni

Exactly, this server is behind an IPSec, the server is unfortunately not local.
Then my XG connects to it through an IPsec.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 4 years ago in reply to Luana Farias

I read something about an Bug in this scenario. I guess the fix will be implemented in the next release, but i am not sure...

Maybe can look up?

Do you already logged a Support Case?

You installed a IPsec Systraffic NAT Rule?

Something like this: https://community.sophos.com/kb/en-us/123336

As far as i know, the Appliance after an Takeover misses the route and cannot reach the DNS Server anymore (because IPsec).

That issue will be resolved anyway in V18 GA, because you can easily move to VTI (Virtual Tunnel interface) IPsec and use static routing.

But until GA of V18, there could be an fix.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to LuCar Toni

Hi LuCar Toni,

I did not find any reported bug with this scenario, I would suggest to open a support case if it hasn't been open yet. Once you (Luana Farias) open a support case, please PM me the case number.

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 FormerMember over 4 years ago in reply to LuCar Toni

Hi LuCar Toni,

I did not find any reported bug with this scenario, I would suggest to open a support case if it hasn't been open yet. Once you (Luana Farias) open a support case, please PM me the case number.

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Luana Farias over 4 years ago in reply to FormerMember

I opened the ticket and sent to you in PM.

Thanks guys.
Cancel
Vote Up 0 Vote Down

Cancel