This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNS or ARP Issue? Help diagnosing error

I am experiencing connection issues on one endpoint - its a Samsung "smart TV".  About 1 out of 3 mornings, the smart TV says its connected to the LAN, but can't see the internet.  I checked the IPS, Web Filter and Firewall logs - no drops.  The smart TV is on the skiplist for the web filter, so that shouldn't be a factor.  All other devices on the LAN work fine.  At first, I thought it was a DNS issue, but various troubleshooting steps that didn't work make me believe otherwise.  I am posting here as resetting the UTM seems to fix the problem, though I doubt its the actual cause of the underlying issue.  I am hopeful you all will tell me ways to find the real culprit.

I run an internal off DNS server on a separate box; clearing its cache and even restarting it does not solve the issue.  Clearing the DNS cache on the UTM didn't solve the problem either (smart tv still says its connected to LAN, but can't see internet).

I should mention the Samsung smart TV is connected via wireless - I am using a netgear WNDR3700v3 in WAP mode.  Power cycling the WAP doesn't solve the problem.  I don't THINK its an issue with the WAP/switch because power cycling it did not help, but power cycling the UTM did.

The Samsung smart TV has a fixed IP in the UTM.

As I said, the problem resolves after rebooting the UTM (after all the above steps).  I'm not saying its the UTM's fault - but it fixes the issue.  I would love to find out the granular underlying issue.  Is it an ARP cache issue (why else would I see the TV making DNS requests, see them in the DNS server logs, believe they're good, but the TV seemingly says it can't reach those sites)?  I don't think its a firewall issue; it wouldn't resolve after rebooting the UTM otherwise.  Admittedly, I am using the UTM (9.3 I think - its up to date) under a home license, on a custom build box using consumer hardware.

Appreciate the help as to what could be wrong, or any steps to better troubleshoot/discover the real culprit.



This thread was automatically locked due to age.
Parents
  • On a day when you see this behavior, take a look to see if the IP (172.16.0.123 in my example) of the Smart TV shows up in any of the log files.  From the command line:

    grep '172\.16\.0\.123' /var/log/* | more

    Did that turn up anything?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • On a day when you see this behavior, take a look to see if the IP (172.16.0.123 in my example) of the Smart TV shows up in any of the log files.  From the command line:

    grep '172\.16\.0\.123' /var/log/* | more

    Did that turn up anything?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
  • Bob,

      I honestly am not great with a CLI, but seeing as you gave me the command, I will fire up Putty and next time it happens run that command.

      Quick question:  I have two uplinks...but only had masquerading set up for one.  In addition, the TV was not weighted towards one uplink or another.  Would this type of behavior "it works sometimes, other times not, but a restart of utm fixes it" be explained by that oversight on my part?

      Thanks much for your help by the way!

  • I think you figured it out without seeing that it wasn't being blocked at all!  To see other common causes of routing problems, check out #3 through #5 in Rulz - https://community.sophos.com/products/unified-threat-management/f/51/t/22065

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Bob - I am a fan of the Rulz - thanks for the help!  I will post back in a few days to let you all know:  1) if the failure to masq one of the uplinks was the issue, or, if it happens 2) what the grep shows.