This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Adding FQDN host object causes restart of DNS and failure in name resolution.

Every time FQDN hosts object is being added to firewall it causes dnscache to restart. During restart name resolution using firewall fails.

New FQDN host object being added to firewall, notice how PID changes for dnscache process. Instead of reloading service it gets restarted.

When checking related logs it stays in "Loading ATP database" for long time, during this name resolution fails.

This means no FQDN object can be added during working hours if firewall is being used as DNS server.

During XML import of FQDN host objects. DNS will be down during whole import process (for us it took around 40 minutes for around 100 objects)

Same behavior has been tested in v18.5 and 19.0.1 of SFOS so this bug has been around for quite a while.

Tested on:

18.5.4

19.0.1

19.5.0

All seems to have same bug.

This thread was automatically locked due to age.

Top Replies

emmosophos over 2 years ago in reply to emmosophos +1 suggested

Hello Rieski, I can see the GES engineer has updated you and this case is now with DEV with the following ID NC-109689 Regards,

0 Rieski over 2 years ago

Ticked ID for this issue is 05841009.

Unable to work with these devices currently as we get a lot of requests daily to whitelist FQDN's. This affect all our 8 firewalls.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 2 years ago

Essentially ATP takes a long time to reload on smaller appliances, but a reload of the ATP should not be the case.

In ATP, do you inspect all or only untrusted services?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Rieski over 2 years ago in reply to LuCar Toni

Only untrusted content. Does not matter if I test it on a XG 210 or 135. DNS is still down for several seconds after adding FQDN host. Removing host does not cause DNS to restart. Also tested this on a clean reset device with only one FW rule for WAN and same thing happens.
Cancel
Vote Up 0 Vote Down

Cancel
0 Rieski over 2 years ago

Here is a sample video how it behaves on all firewalls. DNS down for over 30 seconds. Imagine this when you have to add multiple FQDN entries.

https://www.veed.io/view/cfbf2989-cad9-4926-89d6-f74682b01ceb?sharingWidget=true

This is with a fresh installation of 19.0.1
Cancel
Vote Up 0 Vote Down

Cancel
0 Rieski over 2 years ago

Received confirmation from support that they can replicate this. Hopefully we will see patch that fixes this soon.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 2 years ago in reply to Rieski

Could you link us your support case iD?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Rieski over 2 years ago in reply to LuCar Toni

Case ID is 05841009
Cancel
Vote Up 0 Vote Down

Cancel
0 Rieski over 2 years ago

7 days without reply from support when it were promised in 3 days. No reply to emails. Not looking good Sophos...
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 2 years ago in reply to Rieski

Hello there,

Sorry to hear about this, I have sent an email to the escalation manager about this.

I can see the GES engineer has taken ownership of the case but hasn't sent an update to you.

Let me know if you hear back from them by the end of the day tomorrow!

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 2 years ago in reply to emmosophos

Hello Rieski,

I can see the GES engineer has updated you and this case is now with DEV with the following ID NC-109689

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up +1 Vote Down

Cancel