Resolve local NetBIOS names for DHCP clients fails?

Question

Hi, 
 how come that Sophos XGS simply cannot resolve NetBIOS names for clients, which it served DHCP to? For example, Sophos XGS-136 assigned IP via DHCP to a client, which is listed in DHCP lease list as Computer-alpha , but going to diag or queriying Sophos for NSLOOKUP computer-apha resolves nothing. I am somehow used that device, which delivers IPs will know, what it did and will be able to resolve them back and forth. 
 What am I missing? 
 For example, I want to configure network scanner to send documents to a dozen of computers to their local shared folder. Sophos serves IPs via DHCP, all clients are Wireless, and most natural way would be to setup target folders on scanner via NetBIOS names. At least I did so for every config for many years everywhere, and it simply works. But now when I changed to Sophos, I have to find another solution. And worth mention, DHCP reservations is again something, what Sophos implements just the other way around, not like any other vendor.

PhilippRusch · Answer

As you already noticed, SFOS is pure DNS, there is no NetBIOS resolution possible. 
 And I am very glad this is like it is: pure DNS! 
 So how could you solve your requirements? 
 Windows Clients add the "DNS suffix" to their systemname (=hostname) which is normally the NetBIOS name and in DNS nomenclature this is the first part of an FQDN (Fully Qualified Domain Name). 
 So I suggest, you invent a local DNS domain name like "windows.local", deploy that via DHCP and the clients will resolve "computer-alpha.windows.local". You need to add host entries at the Sophos with the FQDN, then. I am quite sure that you also need to add DNS request routes for windows.local and point them to the local IP of your Sophos firewall, because you do not have a local DNS server. 
 So the Sophos firewall has to use its host entries to reslove those names inside windows.local. 
 Of course you have to use computer-alpha.windows.local as the host name from now on and not the crappy NetBIOS stuff. 
 Test that everything works: use nslookup computer-alpha.windows.local at a client that has already received that DHCP option for the local domainname like you did before with the abbreviated name.

LuCar Toni · Answer

You are correct with your assumption. 
 How are customers deal with this: 
 Customer 1: Small customer, only one firewall, they simply maintain it on their firewall in DNS and DHCP and live with it (Basically a one time change for them and then never touch it again - As not many devices will be usually onboarded). 
 Customer2: They have a Windows DHCP Server, which also serve as DNS and utilize this via DHCP Relay. This works quite well and most bigger customers go down this road, as their AD infrastructure has everything already in place. 
 One approach would be: You can maintain via Sophos Central Groups DNS globally for all Appliances: 
 Central supports groups and can push certain configs to all appliances. One of those settings is DNS. Which means, you can maintain at least DNS on all Appliances. Central does not support DHCP, as this is more a local (Appliance based) setting. 
 About the "Leasing within the Range" - This is an old discussion on weather it is correct to allow it or not: https://www.reddit.com/r/networking/comments/xpxkgp/should_dhcp_reservations_be_created_inside_or/ SFOS approached it by not allowing it inside of the Range. But SFOS also allows you to split up the range, so technically you can do it, it will be messy: 
 
 This would allow you to static map 192.168.214.16 for example.

PhilippRusch · Answer

Hello Andrej, 
 what about using DNS request routing and your central DNS-Server for doing all this internal name resolution stuff? 
 The Drayteks could still be used for Internet DNS resolution to speed things up.

Resolve local NetBIOS names for DHCP clients fails?

Top Replies