Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG API DHCPServer does unexpected

Hallo Community,

i am working on some powershell scripts against the XG APi, when i came across this strange behaviour i do not understand.

I am trying to setup a DHCP Server via the API, everything is nicely wrapped in powershell class that's why i will just throw in the final XG XML Requests and Responses here:

Sending the XG a Wish to add a DHCP

<Request>
  <Login>
    <Username>xgapiuser</Username>
    <Password passwordform="encrypt">111</Password>
  </Login>
  <Set>
    <DHCPServer>
      <Name>DHCP1</Name>
      <Interface>DoNotUseMe.1337</Interface>
      <UseInterfaceIPasGateway>UseInterfaceIPasGateway</UseInterfaceIPasGateway>
      <IPLease>
        <IP>192.168.224.10-192.168.224.20</IP>
      </IPLease>
      <StaticLease />
      <ConflictDetection>Enable</ConflictDetection>
      <SubnetMask>255.255.255.0</SubnetMask>
      <DomainName />
      <Gateway />
      <DefaultLeaseTime>1440</DefaultLeaseTime>
      <MaxLeaseTime>2880</MaxLeaseTime>
      <UseApplianceDNSSettings>Disable</UseApplianceDNSSettings>
      <PrimaryDNSServer>192.168.224.224</PrimaryDNSServer>
      <SecondaryDNSServer>192.168.178.178</SecondaryDNSServer>
      <PrimaryWINSServer />
      <SecondaryWINSServer />
    </DHCPServer>
  </Set>
</Request>

The firewall does create and the DHCP and i can see everything is fine in the webinterface:

When i now query the DHCPServer settings via the API:

<Request>
  <Login>
    <Username>xgapiuser</Username>
    <Password passwordform="encrypt">111</Password>
  </Login>
  <Get>
    <DHCPServer>
      <Filter>
        <key criteria="=" name="Name">DHCP1</key>
      </Filter>
    </DHCPServer>
  </Get>
</Request>

This is the response what i get:

<Response APIVersion="1900.1" IPS_CAT_VER="0">
  <Login>
    <status>Authentication Successful</status>
  </Login>
  <DHCPServer transactionid="">
    <Name>DHCP1</Name>
    <Status>1</Status>
    <Interface>DoNotUseMe.1337</Interface>
    <IPLease>
      <IP>192.168.224.10-192.168.224.20</IP>
    </IPLease>
    <ConflictDetection>Enable</ConflictDetection>
    <LeaseForRelay>Disable</LeaseForRelay>
    <SubnetMask>255.255.255.0</SubnetMask>
    <DomainName />
    <DefaultLeaseTime>1440</DefaultLeaseTime>
    <MaxLeaseTime>2880</MaxLeaseTime>
    <UseApplianceDNSSettings>Disable</UseApplianceDNSSettings>
    <PrimaryDNSServer>172.30.102.254</PrimaryDNSServer>
    <SecondaryDNSServer />
    <PrimaryWINSServer />
    <SecondaryWINSServer />
    <Gateway>192.168.224.1</Gateway>
    <UseInterfaceIPasGateway>UseInterfaceIPAsGateway</UseInterfaceIPasGateway>
  </DHCPServer>
</Response>

At first glance everything looks fine, but at a closer look you can see wrong dns servers.

The PrimaryDNSServer and SecondaryDNSServer are just wrong or missing.

    <UseApplianceDNSSettings>Disable</UseApplianceDNSSettings>
    <PrimaryDNSServer>172.30.102.254</PrimaryDNSServer>
    <SecondaryDNSServer />

I tried updating the setting again via an update command:

<Request>
  <Login>
    <Username>xgapiuser</Username>
    <Password passwordform="encrypt">111</Password>
  </Login>
  <Set operation="Update">
    <DHCPServer>
      <Name>DHCP1</Name>
      <Interface>DoNotUseMe.1337</Interface>
      <UseInterfaceIPasGateway>UseInterfaceIPAsGateway</UseInterfaceIPasGateway>
      <IPLease>
        <IP>192.168.224.10-192.168.224.20</IP>
      </IPLease>
      <StaticLease />
      <ConflictDetection>Enable</ConflictDetection>
      <SubnetMask>255.255.255.0</SubnetMask>
      <DomainName />
      <Gateway>192.168.224.1</Gateway>
      <DefaultLeaseTime>1440</DefaultLeaseTime>
      <MaxLeaseTime>2880</MaxLeaseTime>
      <UseApplianceDNSSettings>Disable</UseApplianceDNSSettings>
      <PrimaryDNSServer>192.168.14.14</PrimaryDNSServer>
      <SecondaryDNSServer>192.168.13.13</SecondaryDNSServer>
      <PrimaryWINSServer />
      <SecondaryWINSServer />
    </DHCPServer>
  </Set>
</Request>

But no luck. The settings will change if you take a look in the webinterface but, the api will always respone with the same PrimaryDNSServer Settings.

If you have multiple DHCP Server on multiple Nics with different settings, the PrimaryDNSServer is at least on my system always the same.

Anyone did excpierence such an issue ?



This thread was automatically locked due to age.
Parents
  • Hi Michael Schneider, Can you please confirm the output of the below command from this XG?

    console> system dhcp conf-generation-method show 

    If it is set to the old method, please change it to new and confirm the status again.

  • I did find something else. 
    I changed it to new and the behavior is exactly the same, but if i use the Filter Element in the query for DHCP Server as mentioned above, the result will be wrong.

    If i query all dhcp settings with:

    <Request>
      <Login>
        <Username>xgapiuser</Username>
        <Password passwordform="encrypt">111</Password>
      </Login>
      <Get>
        <DHCPServer /> #HERE NO FILTER
      </Get>
    </Request>

    Then i get a result which every dhcp and here is a "part" of it:

    <DHCPServer transactionid="">
        <Name>DHCP1</Name>
        <Status>1</Status>
        <Interface>DoNotUseMe.1337</Interface>
        <IPLease>
          <IP>192.168.224.10-192.168.224.20</IP>
        </IPLease>
        <ConflictDetection>Enable</ConflictDetection>
        <LeaseForRelay>Disable</LeaseForRelay>
        <SubnetMask>255.255.255.0</SubnetMask>
        <DomainName />
        <DefaultLeaseTime>1440</DefaultLeaseTime>
        <MaxLeaseTime>2880</MaxLeaseTime>
        <UseApplianceDNSSettings>Disable</UseApplianceDNSSettings>
        <PrimaryDNSServer>192.168.224.224</PrimaryDNSServer>
        <SecondaryDNSServer>192.168.178.178</SecondaryDNSServer>
        <PrimaryWINSServer />
        <SecondaryWINSServer />
        <Gateway>192.168.224.1</Gateway>
        <UseInterfaceIPasGateway>UseInterfaceIPAsGateway</UseInterfaceIPasGateway>
      </DHCPServer>

    And here we go with the correct DHCP Settings.
    Seems to be a filtering problem on the XG Site when using:

        <DHCPServer>
          <Filter>
            <key criteria="=" name="Name">DHCP1</key>
          </Filter>
        </DHCPServer>

    I still to get the wrong result

Reply
  • I did find something else. 
    I changed it to new and the behavior is exactly the same, but if i use the Filter Element in the query for DHCP Server as mentioned above, the result will be wrong.

    If i query all dhcp settings with:

    <Request>
      <Login>
        <Username>xgapiuser</Username>
        <Password passwordform="encrypt">111</Password>
      </Login>
      <Get>
        <DHCPServer /> #HERE NO FILTER
      </Get>
    </Request>

    Then i get a result which every dhcp and here is a "part" of it:

    <DHCPServer transactionid="">
        <Name>DHCP1</Name>
        <Status>1</Status>
        <Interface>DoNotUseMe.1337</Interface>
        <IPLease>
          <IP>192.168.224.10-192.168.224.20</IP>
        </IPLease>
        <ConflictDetection>Enable</ConflictDetection>
        <LeaseForRelay>Disable</LeaseForRelay>
        <SubnetMask>255.255.255.0</SubnetMask>
        <DomainName />
        <DefaultLeaseTime>1440</DefaultLeaseTime>
        <MaxLeaseTime>2880</MaxLeaseTime>
        <UseApplianceDNSSettings>Disable</UseApplianceDNSSettings>
        <PrimaryDNSServer>192.168.224.224</PrimaryDNSServer>
        <SecondaryDNSServer>192.168.178.178</SecondaryDNSServer>
        <PrimaryWINSServer />
        <SecondaryWINSServer />
        <Gateway>192.168.224.1</Gateway>
        <UseInterfaceIPasGateway>UseInterfaceIPAsGateway</UseInterfaceIPasGateway>
      </DHCPServer>

    And here we go with the correct DHCP Settings.
    Seems to be a filtering problem on the XG Site when using:

        <DHCPServer>
          <Filter>
            <key criteria="=" name="Name">DHCP1</key>
          </Filter>
        </DHCPServer>

    I still to get the wrong result

Children
No Data