Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 7 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 586 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG API DHCPServer does unexpected

Michael Schneider

Hallo Community,

i am working on some powershell scripts against the XG APi, when i came across this strange behaviour i do not understand.

I am trying to setup a DHCP Server via the API, everything is nicely wrapped in powershell class that's why i will just throw in the final XG XML Requests and Responses here:

Sending the XG a Wish to add a DHCP

<Request>
  <Login>
    <Username>xgapiuser</Username>
    <Password passwordform="encrypt">111</Password>
  </Login>
  <Set>
    <DHCPServer>
      <Name>DHCP1</Name>
      <Interface>DoNotUseMe.1337</Interface>
      <UseInterfaceIPasGateway>UseInterfaceIPasGateway</UseInterfaceIPasGateway>
      <IPLease>
        <IP>192.168.224.10-192.168.224.20</IP>
      </IPLease>
      <StaticLease />
      <ConflictDetection>Enable</ConflictDetection>
      <SubnetMask>255.255.255.0</SubnetMask>
      <DomainName />
      <Gateway />
      <DefaultLeaseTime>1440</DefaultLeaseTime>
      <MaxLeaseTime>2880</MaxLeaseTime>
      <UseApplianceDNSSettings>Disable</UseApplianceDNSSettings>
      <PrimaryDNSServer>192.168.224.224</PrimaryDNSServer>
      <SecondaryDNSServer>192.168.178.178</SecondaryDNSServer>
      <PrimaryWINSServer />
      <SecondaryWINSServer />
    </DHCPServer>
  </Set>
</Request>

The firewall does create and the DHCP and i can see everything is fine in the webinterface:

When i now query the DHCPServer settings via the API:

<Request>
  <Login>
    <Username>xgapiuser</Username>
    <Password passwordform="encrypt">111</Password>
  </Login>
  <Get>
    <DHCPServer>
      <Filter>
        <key criteria="=" name="Name">DHCP1</key>
      </Filter>
    </DHCPServer>
  </Get>
</Request>

This is the response what i get:

<Response APIVersion="1900.1" IPS_CAT_VER="0">
  <Login>
    <status>Authentication Successful</status>
  </Login>
  <DHCPServer transactionid="">
    <Name>DHCP1</Name>
    <Status>1</Status>
    <Interface>DoNotUseMe.1337</Interface>
    <IPLease>
      <IP>192.168.224.10-192.168.224.20</IP>
    </IPLease>
    <ConflictDetection>Enable</ConflictDetection>
    <LeaseForRelay>Disable</LeaseForRelay>
    <SubnetMask>255.255.255.0</SubnetMask>
    <DomainName />
    <DefaultLeaseTime>1440</DefaultLeaseTime>
    <MaxLeaseTime>2880</MaxLeaseTime>
    <UseApplianceDNSSettings>Disable</UseApplianceDNSSettings>
    <PrimaryDNSServer>172.30.102.254</PrimaryDNSServer>
    <SecondaryDNSServer />
    <PrimaryWINSServer />
    <SecondaryWINSServer />
    <Gateway>192.168.224.1</Gateway>
    <UseInterfaceIPasGateway>UseInterfaceIPAsGateway</UseInterfaceIPasGateway>
  </DHCPServer>
</Response>

At first glance everything looks fine, but at a closer look you can see wrong dns servers.

The PrimaryDNSServer and SecondaryDNSServer are just wrong or missing.

    <UseApplianceDNSSettings>Disable</UseApplianceDNSSettings>
    <PrimaryDNSServer>172.30.102.254</PrimaryDNSServer>
    <SecondaryDNSServer />

I tried updating the setting again via an update command:

<Request>
  <Login>
    <Username>xgapiuser</Username>
    <Password passwordform="encrypt">111</Password>
  </Login>
  <Set operation="Update">
    <DHCPServer>
      <Name>DHCP1</Name>
      <Interface>DoNotUseMe.1337</Interface>
      <UseInterfaceIPasGateway>UseInterfaceIPAsGateway</UseInterfaceIPasGateway>
      <IPLease>
        <IP>192.168.224.10-192.168.224.20</IP>
      </IPLease>
      <StaticLease />
      <ConflictDetection>Enable</ConflictDetection>
      <SubnetMask>255.255.255.0</SubnetMask>
      <DomainName />
      <Gateway>192.168.224.1</Gateway>
      <DefaultLeaseTime>1440</DefaultLeaseTime>
      <MaxLeaseTime>2880</MaxLeaseTime>
      <UseApplianceDNSSettings>Disable</UseApplianceDNSSettings>
      <PrimaryDNSServer>192.168.14.14</PrimaryDNSServer>
      <SecondaryDNSServer>192.168.13.13</SecondaryDNSServer>
      <PrimaryWINSServer />
      <SecondaryWINSServer />
    </DHCPServer>
  </Set>
</Request>

But no luck. The settings will change if you take a look in the webinterface but, the api will always respone with the same PrimaryDNSServer Settings.

If you have multiple DHCP Server on multiple Nics with different settings, the PrimaryDNSServer is at least on my system always the same.

Anyone did excpierence such an issue ?



This thread was automatically locked due to age.
  • 0

    Hi Michael Schneider, Can you please confirm the output of the below command from this XG?

    console> system dhcp conf-generation-method show 

    If it is set to the old method, please change it to new and confirm the status again.

    Regards,

    Vishal Ranpariya
    Technical Account Manager | Sophos Technical Support
    Sophos Support Videos | Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts |
    If a post solves your question use the 'This helped me' link.

  • 0 in reply to Vishal_R

    It is set to old. How to change ? And what does ist ?

  • 0

    You could check after the API push the csc.log and applog.log if there is an error. 

    __________________________________________________________________________________________________________________

  • 0 in reply to Michael Schneider

    Hi Michael,

    The below command will set it with a new method.

    console> sy dhcp conf-generation-method new

    In past it was observed with  "dhcp static-entry-scope" to "global" wrong options are getting sent to the client, options like default gateway, lease time, DNS, etc. Based on that required changes are taken at the OS level and the same changes in CLI with the switching from the old to the new method will be in effect. 

    Regards,

    Vishal Ranpariya
    Technical Account Manager | Sophos Technical Support
    Sophos Support Videos | Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts |
    If a post solves your question use the 'This helped me' link.

  • 0 in reply to Vishal_R

    I did find something else. 
    I changed it to new and the behavior is exactly the same, but if i use the Filter Element in the query for DHCP Server as mentioned above, the result will be wrong.

    If i query all dhcp settings with:

    <Request>
  <Login>
    <Username>xgapiuser</Username>
    <Password passwordform="encrypt">111</Password>
  </Login>
  <Get>
    <DHCPServer /> #HERE NO FILTER
  </Get>
</Request>

    Then i get a result which every dhcp and here is a "part" of it:

    <DHCPServer transactionid="">
    <Name>DHCP1</Name>
    <Status>1</Status>
    <Interface>DoNotUseMe.1337</Interface>
    <IPLease>
      <IP>192.168.224.10-192.168.224.20</IP>
    </IPLease>
    <ConflictDetection>Enable</ConflictDetection>
    <LeaseForRelay>Disable</LeaseForRelay>
    <SubnetMask>255.255.255.0</SubnetMask>
    <DomainName />
    <DefaultLeaseTime>1440</DefaultLeaseTime>
    <MaxLeaseTime>2880</MaxLeaseTime>
    <UseApplianceDNSSettings>Disable</UseApplianceDNSSettings>
    <PrimaryDNSServer>192.168.224.224</PrimaryDNSServer>
    <SecondaryDNSServer>192.168.178.178</SecondaryDNSServer>
    <PrimaryWINSServer />
    <SecondaryWINSServer />
    <Gateway>192.168.224.1</Gateway>
    <UseInterfaceIPasGateway>UseInterfaceIPAsGateway</UseInterfaceIPasGateway>
  </DHCPServer>

    And here we go with the correct DHCP Settings.
    Seems to be a filtering problem on the XG Site when using:

        <DHCPServer>
      <Filter>
        <key criteria="=" name="Name">DHCP1</key>
      </Filter>
    </DHCPServer>

    I still to get the wrong result

  • 0 in reply to LuCar Toni

    There is alot going on there in the logs, but i could not see something obviously posting errors. But it seems to be a Filter problem, i mentioned above :)

  • 0 in reply to Vishal_R

    Hello Vishal_R,

    i run the command and the setting is now new (whatever that means).

    Results are exactly the same.

    For now i solved it by queries all the DHCP Servers and filter them manually on my side.

Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?

Unfiltered HTML