Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 2 replies
  • Subscribers 5 subscribers
  • Views 2763 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Availability Groups and internal DNS resolution by UTM as DNS server

TheExpert

Hi all,

at first I wish you all a happy new year.

I'm using the latest UTM release and want to test the Availability Group in the Network Definitions.

My use case: I'm accessing my file server by using an alternate DNS name, added to the host object of the file server in the Network Definitions of the UTM so that this name can be resolved by the UTM which is the DNS server for my internal network. This is working fine. Now I'm thinking about setting up a second file server which should be reachable by the same name when the primary file server is unavailable.

For this, an Availability Group is a good way. I have no need for load balancing which doesn't work for services running in the same network where the clients systems are connected to.

I tried this out by deleting the alternate name from the host object in the Network Definitions and then set up an Availability Group using this alternate name with adding the two hosts which are used as file servers. The resolution of the Availbality Group to the host IP address works perfect and changes by changing the sequence of the hosts. But if trying to access the file server by the name of the Availability Group doesn't work. Doing a 'nslookup' on the client shows the UTM as DNS server but the name can't be resolved by the UTM. Is this a behavior of the UTM by design? Are Availability Groups not resolved as DNS names in the UTM? What do I have to set up for getting my use case working?

Thank you and kind Regards

TheExpert



This thread was automatically locked due to age.
Parents
  • +1

    Availability groups are not the same as DNS as you have found out. An availability group can be used by the UTM itself to failover to the next machine if the current is unavailable.

    We use this in ie. as DNS-resolver; the availability group that is configured as our DNS resolver has a few different external DNS-servers in them so there's always DNS resolution if a server fails.

    We also use an availability group with all our AD domain controllers in it in the order that we would like them to be probed; so 1st is DC on site, second is DC behind the fastest connection, etc.

    That way usually the DC on-site will be queried for RADIUS and AD SSO, but if it should be unavailable it just queries another DC behind a VPN-connection.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Reply
  • +1

    Availability groups are not the same as DNS as you have found out. An availability group can be used by the UTM itself to failover to the next machine if the current is unavailable.

    We use this in ie. as DNS-resolver; the availability group that is configured as our DNS resolver has a few different external DNS-servers in them so there's always DNS resolution if a server fails.

    We also use an availability group with all our AD domain controllers in it in the order that we would like them to be probed; so 1st is DC on site, second is DC behind the fastest connection, etc.

    That way usually the DC on-site will be queried for RADIUS and AD SSO, but if it should be unavailable it just queries another DC behind a VPN-connection.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Children
No Data
Unfiltered HTML