Hi,
I apologise if this is an answered question but this product isn't something I've previously used and was installed by another IT contractor.
The customer has a main office. They previously used a RED 10 in a branch office. That unit has been redeployed to a new office.
The UTM has an existing configuration for the main office and no issues are reported. It has firewall rules (which curiously I cannot see in a table, I have to select each one to see what it does, not even a description field appears). So the system has history, no documentation and the previous IT and the customer don't talk. Background over...
We have a small office that has a DSL modem and a digital phone pack (the ISP provides VoIP using this DSL modem, preconfigured). I can't therefore assume that I can modify DHCP, DNS etc for the branch office. However we do have an AD server in the main office and the customer would like to authenticate to that.
Given those criteria, a transparent split mode would seem to offer the best solution. The branch would send their DNS requests to the AD DNS server and the branch would manage their own DHCP. Internet traffic would go direct via the ISP.
I configured the RED 10 via the UTM web interface and connected the WAN I/F of the RED to the LAN I/F of the DSL modem. No other connections are made to the DSL modem. The LAN I/F of the RED is connected to the customers managed switch.
I configured the UTM as per the technical guide. I created a firewall rule that allowed the branch network to access ANY with any source and service.
The tunnel configures and sets up. I can ping the IP of the AD and another application server.
If I use NSLOOKUP and change the server to that of the AD, I cannot perform any local queries. I can query external IP addresses without issue.
It seems to me that the UTM is actually intercepting my DNS queries as a proxy. It can't resolve my internal names, but can the external. To test further I added a rule to firewall allowing my branch network DNS access to my DNS server. I could now connect via a Telnet session to port 53 on my DNS server. However, still when I use nslookup and perform a local query, I get no response.
I've read a few of the posts here and a few appear similar. I see answers relating to adding branch network as allowed in the DNS tab, but I thought this was relating to Standard/Split.
What's frustrating is that something that would take me around 30minutes to configure and test as a simple ipsec VPN tunnel has consumed several hours as I have to travel to the branch office to test.
Is there something fundamental I am not doing correctly?
Regards
Clifford
This thread was automatically locked due to age.
