I have been fighting DNS issues on my UTM9 (SG310 on 9.315-2) for several weeks and it is driving me crazy. I am hoping someone might be able to help since no one else that I've had look at the issue is able to figure this out. We seem to be having DNS issues and the high latency on requests is slowing down internet traffic (particularly to google-based sites). We are a school of about 1200 users and I have been testing and changing network, AD, and firewall configurations for weeks trying to get DNS responses to be faster. I have found that during the times when students are in class and using their laptops then we have more inconsistent connectivity testing results with many DNS errors or high latency warnings. I am referring to general network usage, not high bandwidth usage times. Sophos resources are in the teens for CPU and memory during these times. I have settled on the chrome extension called Connectivity Diagnostics as it seems to do a nice range of tests and specifically tests google sites. I also have had a Fortinet firewall installed alongside the Sophos with test VLAN traffic running through the Fortinet. Through my many many tests and configuration changes I have learned this –
1. If a client runs through the Fortinet and uses an external DNS (google/opendns/etc) on their Ethernet adapter then the diagnostics do not fail. [Fortinet client + external DNS = OK]
2. If a client runs through the Fortinet but uses a local AD DNS server that runs through the Sophos then I will get inconsistent results with slow DNS resolution and HTTP latency test errors. [Fortinet client + local DNS on Sophos = slow]
3. If a client runs through Fortinet and the local AD DNS runs through Fortinet then the diagnostics do not fail. [Fortinet client + local DNS on Fortinet = OK]
4. If a client runs through the Sophos but uses local AD DNS that runs through Fortinet then results are mostly good. [Sophos client + local DNS on Fortinet = mostly OK]
5. If a client runs through the Sophos and uses local AD DNS on Sophos then slow DNS resolution and other latency errors. Very slow at times particularly when network usage is high (not necessarily bandwidth usage). [Sophos client + local DNS on Sophos = very slow]
I have used the Sophos best practice document for Sophos DNS config, tweaking guides DNS configs, and the recent suggestions by jalil1408 on this forum (https://community.sophos.com/products/unified-threat-management/astaroorg/f/53/t/34929) but nothing seems to give me the same result as when I run through the Fortinet. I have a run Any -> DNS -> Any in place and have turned off as many services as I can. We really only do Firewall, Intrusion Prevention, and Web Filtering right now. I have even turned off the last two and still get slow response times. I restarted the firewall last night with no success and have cleaned up AD and my local DNS servers. The fact that they run fine when going out the Fortinet makes me feel pretty confident that internally I am running ok. What else in the Sophos would be slowing down browsing so much? I have a few test results from the diagnostics program added below in case they are helpful. Please let me know what questions you have and thanks for any help!!
From - "Chrome Connectivity Diagnostics":
https://chrome.google.com/webstore/detail/chrome-connectivity-diagn/eemlkeanncmjljgehlbplemhmdmalhdc?utm_source=gmail
SUMMARY
Test Name: Resolver Latency Test Test ID: 8 Test result: Problem detected
CRITERIA
Average DNS resolution time (ms) benchmark above which a problem verdict is rendered: 500
DETAILS
Thu Sep 24 2015 14:50:46 GMT-0400 (Eastern Daylight Time) - Attempting to resolve hostname #: 0 ruhtcpoz-ccd-testing-v4.metric.gstatic.com
Thu Sep 24 2015 14:51:15 GMT-0400 (Eastern Daylight Time) - Total DNS resolution time for all tests (ms): 26913
Thu Sep 24 2015 14:51:15 GMT-0400 (Eastern Daylight Time) - Total DNS hosts resolved: 3
Thu Sep 24 2015 14:51:15 GMT-0400 (Eastern Daylight Time) - Average DNS resolution time (ms): 8971
This thread was automatically locked due to age.
