DNS request to DNS over Site2Site VPN

Question

Hello! 
 
 We are using a Hardware Firewall XGS-2100 to connect to two datacenters running our AD Controller there. The AD is also our DNS Server. 
 This worked fine for a long time. For some reason one of the VPN stopped working and one of the AD Controller was not reachable anymore. 
 
 Since the XG2100 is used to handle the DNS requests of the clients. It turned out that not every request was answered anymore. 
 
 So this lead to the following questing: 
 Is the Firewall not caching any DNS data for client requests? Is it only relaying the request to the DNS set in the configuration? 
 And since I still had a working AD Controller why was the request not sent to the working one? Is this just a randomly forwarding the request? So if one DSN server is down will request be still sent to this and fail? 
 Thanks! 
 Christian

Adam Dodge · Answer

Hi Christian, 
 
 Depending on the domain you're trying to resolve, the firewall can only cache the DNS entry based on the TTL. 
 
 For your working AD Controller, kindly add its IP address to the XG's DNS request route so the XG firewall can reroute the request to that server.

If the issue persist we need to check how the XG is handling the DNS request using packet capture (reference: Sophos Firewall: How to TCPdump - Recommended Reads - Sophos Firewall - Sophos Community ) 
 
 tcpdump -veni any host {client PC IP} or host {domain name} and port 53; this should show any activity with the Client PC IP or the domain that needs to be resolved and the DNS port 53 
 
 Lets us know how this works on your end. Hope this helps.

DNS request to DNS over Site2Site VPN

Top Replies