Sophos UTM: Decommissioning of obsolete URL categorization services CFFS.Click here for important info.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 36 replies
  • Subscribers 35 subscribers
  • Views 25168 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos xg can't resolve own hostname and internal server

initB10r

Hello all,

I am currently trying to configure Sophos xg to replace my Fritzbox.

From problems with certificates, I have become aware that my DNS resolution for internal hosts and the xg itself is not working.

Currently I have only a test client, which has the xg entered as the default gateway and DNS server.

When accessing blocked websites I always had problems with the certificate and had read somewhere that I should choose the hostname of the firewall as redirection page so that there are no problems with the CN.
Here I found out that I can not make a ping on the name of the XG. Now I added the XG as DNS-HOST, but it still does not work. Also other host, which are meanwhile also registered as DNS host I can not reach via ping.

Does anyone have an idea what I have configured wrong?

Many greetings
Marc



This thread was automatically locked due to age.
Parents
  • 0

    the first step would be to check if DNS is allowed on the Zone.

    An other useful thing is packet capture

    you can see if and probably why something like DNS is blocked

  • 0 in reply to LHerzog

    DNS is enabled in the zone LAN

    Here is the result from the packet capture. Where can I see here if it has been blocked?

    Here is the result of nslookup:

    nslookup schneckenxg
    DNS request timed out.
        timeout was 2 seconds.
    Server:  UnKnown
    Address:  172.16.0.2

    Nicht autorisierende Antwort:
    DNS request timed out.
        timeout was 2 seconds.
    Name:    schneckenxg
    Address:  172.16.0.2

    172.16.0.2 is the LAN Interface
    172.16.3.103 is the client

  • 0 in reply to initB10r

    Hi,

    Please post a copy of your DNS setup, there appears to be an issue with the XG DNS configuration. Also check the DNS setting on your test device.

    Ian

    XG115W - v19.5.3 mr-3 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hello Ian,

    hopefully here are all the information:

    Have I forgotten a configuration? I'm currently having a bit of trouble with the configuration. I had administered an asg8 years ago.

    Regards
    Marc

  • 0 in reply to initB10r

    Hi,

    thank you for all there screenshots.

    The XG should be using an external DNS, where you would add the XG as an internal DNS is in the DHCP settings.

    Ian

    XG115W - v19.5.3 mr-3 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hello Ian,

    is it not possible to have only the XG as DNS server?

    Regards
    Marc

  • 0 in reply to initB10r

    Yes,  it is but on the internal side not the external side. You need to provide some external DNS access to resolve lookups.

    Ian

    XG115W - v19.5.3 mr-3 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hello Ian,

    thanks for the answer

    Doesn't the lookup of external names work automatically via the WAN interface? I am not sure what I need to change.

    Sorry for possible stupid questions.

    Regards
    Marc

  • 0 in reply to initB10r

    But, you have told the WAN interface to use the internal address of the XG as its lookup.

    In the DNS settings change the DNS to use DHCP settings for the WAN interface or used fixed as you have.

    I have mine set to use my ISP's DNS IP4 and IPv6, alot of people use 8.8.8.8 or 4.4.4.4 or 1.1.1.1 which are a mix of Google and Cloudflare DNS.

    Ian

    XG115W - v19.5.3 mr-3 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hi Ian,

    now I changed DNS 1 to 8.8.8.8 and the dns query configuration

    The network configuration on my client looks like this:

       IPv4-Adresse  . . . . . . . . . . : 172.16.3.100
       Subnetzmaske  . . . . . . . . . . : 255.255.248.0
       Standardgateway . . . . . . . . . : 172.16.0.2 (XG)
       DNS-Server  . . . . . . . . . . . : 172.16.0.2(XG)

    Unfortunately, it still doesn't work.

    Even ipconfig /flushdns on the client does not help.

    Regards

    Marc

  • 0 in reply to initB10r

    Please remove the 127 address, that is an internal nonevroutable address and should not be on the external interface.

    then allow time for the XG to update its tables.

    ian

    XG115W - v19.5.3 mr-3 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hi Ian,

    I have now removed 127 and waited about 3 hours. Unfortunately without success. Restarting the XG does not work either.

    What I notice is that when I execute the following command on my client, a DNS error occurs:

        netsh interface ipv4 set dnsservers name="Ethernet 2" static 172.16.0.2

        The configured DNS server is incorrect or does not exist.
        
    Any idea?

    Regards

    Marc

Reply
  • 0 in reply to rfcat_vk

    Hi Ian,

    I have now removed 127 and waited about 3 hours. Unfortunately without success. Restarting the XG does not work either.

    What I notice is that when I execute the following command on my client, a DNS error occurs:

        netsh interface ipv4 set dnsservers name="Ethernet 2" static 172.16.0.2

        The configured DNS server is incorrect or does not exist.
        
    Any idea?

    Regards

    Marc

Children
  • 0 in reply to initB10r

    from your screenshots the XG is now using 8.8.8.8 as primary DNS. It should now be able to resolve names on it's own.

    btw. the 127.0.0.1 should be OK to stay there as second resolver. This would be the only way to resolve names, that are only configured on the XG with static mappings.

    On XG when you go to diagnostic > tools > name lookup

    Select lookup using all configured servers

    can you resolve external FQDN?

  • 0 in reply to initB10r

    and can the lan machines resolve external DNS, too?

    In the screenshots you posted, you use something like

    have you tried using a FQDN like schneckenXG.mydomain.local -> 172.16.0.2

    Packet Capture looks good.

  • 0 in reply to LHerzog
    LHerzog said:

    These are static DNS HOSTS to test a host other than just the XG.

    I can ping other external hosts. Unfortunately, an attempt with an FQDN "schneckenXG.schneckenhaus.local" did not help either:

    "schneckenhaus.local" is defined in my dhcp-Server:

    Any idea?

  • 0 in reply to LHerzog
    LHerzog said:
    btw. the 127.0.0.1 should be OK to stay there as second resolver. This would be the only way to resolve names, that are only configured on the XG with static mappings.

    This is not correct, if you are using the XG as your internal DNS. The external FQDN is different to the internal FQDN and there appears to be a firewall rule allowing LAN devices totally to the external DNS and not use the internal DNS looking at the PCAP result.

    There is no real reason to allow users to use external DNS when you have better security using the XG DNS, that is one less exposure point.

    Ian

    XG115W - v19.5.3 mr-3 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    I am really clueless. Is there a possibility for users of a home licence to open a case?

  • 0 in reply to initB10r

    Sorry, no you must rely on the forum members for support.

    I use the internal DNS settings to access my XG GUI otherwise I receive security errors and fail to connect.

    I do not add the .local to my devices, just the name in the DNS and DHCP assignments.

    The XG uses external DNS addresses and the my internal devices use the XG internal DNS for each network.

    Ian

    XG115W - v19.5.3 mr-3 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk
    rfcat_vk said:
    I do not add the .local to my devices, just the name in the DNS and DHCP assignments.

    This is exactly how it should work here. The attempt with *.local was only a test.

    Is there still a switch somewhere where I have to activate the internal DNS server of the XG?

    What is interesting for me is the error message from Windows when I statically enter the DNS via commandline:

        netsh interface ipv4 set dnsservers name="Ethernet 2" static 172.16.0.2
        The configured DNS server is incorrect or does not exist.

    Regards
    Marc

  • 0 in reply to initB10r

    No, there is no switch other than adding the address in the dhcp settings. I assume Ethernet 2 is the second Nic on the pc. If you are using the dhcp function the dns should be assigned by the dhcp server.

    ian

    XG115W - v19.5.3 mr-3 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    I don't think it makes any difference whether the DNS server is assigned statically or via DHCP. Only the DNS suffix is different. The question is why Windows notices that the DNS server is wrong.

    Setup the ipv4 to DHCP
    C:\Windows\system32>netsh interface ipv4 set address name="Ethernet 2" source=dhcp
    C:\Windows\system32>netsh interface ipv4 set dnsservers name="Ethernet 2" source=dhcp
    C:\Windows\system32>ipconfig /all
    ...
    Ethernet-Adapter Ethernet 2:

       Verbindungsspezifisches DNS-Suffix: schneckenhaus.local
       Beschreibung. . . . . . . . . . . : Dell GigabitEthernet
       Physische Adresse . . . . . . . . : 34-48-ED-B9-1E-F9
       DHCP aktiviert. . . . . . . . . . : Ja
       Autokonfiguration aktiviert . . . : Ja
       IPv4-Adresse  . . . . . . . . . . : 172.16.3.100(Bevorzugt)
       Subnetzmaske  . . . . . . . . . . : 255.255.248.0
       Lease erhalten. . . . . . . . . . : Dienstag, 24. August 2021 15:53:40
       Lease läuft ab. . . . . . . . . . : Mittwoch, 25. August 2021 15:53:40
       Standardgateway . . . . . . . . . : 172.16.0.2
       DHCP-Server . . . . . . . . . . . : 172.16.0.2
       DNS-Server  . . . . . . . . . . . : 172.16.0.2
       NetBIOS über TCP/IP . . . . . . . : Aktiviert
    ...

    Setup the ipv4 to static
    C:\Windows\system32>netsh interface ipv4 set address name="Ethernet 2" static 172.16.3.100 255.255.248.0 172.16.0.2
    C:\Windows\system32>netsh interface ipv4 set dnsservers name="Ethernet 2" static 172.16.0.2
            The configured DNS server is incorrect or does not exist.
    C:\Windows\system32>ipconfig /all
    ...
    Ethernet-Adapter Ethernet 2:

       Verbindungsspezifisches DNS-Suffix:
       Beschreibung. . . . . . . . . . . : Dell GigabitEthernet
       Physische Adresse . . . . . . . . : 34-48-ED-B9-1E-F9
       DHCP aktiviert. . . . . . . . . . : Nein
       Autokonfiguration aktiviert . . . : Ja
       IPv4-Adresse  . . . . . . . . . . : 172.16.3.100(Bevorzugt)
       Subnetzmaske  . . . . . . . . . . : 255.255.248.0
       Standardgateway . . . . . . . . . : 172.16.0.2
       DNS-Server  . . . . . . . . . . . : 172.16.0.2
       NetBIOS über TCP/IP . . . . . . . : Aktiviert
    ...

    In any case, no ping to a DNS host works in both variants.
    If no one has any more ideas, I'll perform a factory reset and hope that this will solve the problem.

Unfiltered HTML