Can't get to DMZ servers when internet goes down

Hello Josh,

Thank you for contacting the Sophos Community! 

How are the users accessing the Server in the DMZ? using FQDN?

Are you using hairpin?

Regards,

Either fqdn or IP address result in the same failure.  DNS entries for the DMZ are supposed to point them directly toward a certain subnet, but it appears when the primary internet line is down that it tries to push the traffic out the second connection despise the DMZ being locally accessible.  We are not using "hairpin" as far as I know.

Hi Josh,

does the traffic to the DMZ need to go to the internet, you could setup an FQDN in the XG using the internal address of the server, do not tick advertise on WAN and create a rule to allow the traffic between the subnets.

Ian

Hello Josh,

Thank you for the follow-up!

Are you running v17 or v18?

Regards,

Hello Josh,

Thank you for the follow-up!

Are you running v17 or v18?

Regards,

Currently version 18, MR1 (About to upgrade to MR3)

Hello Josh,

Please take a screenshot of the NAT rules you have configured for this server, before or after you update to MR3.

Regards,

Would NAT rules really apply for a servers internal address? Shouldn't machines in my local network contact a server on the DMZ not through a NAT rule but directly via the IP address/DNS entry we have specified?

Hello Josh,

If it is internal, then it shouldn't! If users access the server using a FQDN and this one resolves to an external Public IP from their computer, then yes! 

Regards,

They are accessing the device via FQDN but not from an external source.  They are connecting from our internal LAN.  Is DMZ considered a directly attached network?  I assumed it was and therefore wouldn't need a route statement for devices on my LAN to access them.