Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 8 replies
  • Subscribers 29 subscribers
  • Views 36871 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG DNS request route (internal dns forward)

DanSand

Hello together,

we have a problem with the dns request route configuration. We have multiple remote sites and a datacenter. The datacenter has a ad/dc with dns function. The clients in the remote site sends the dns requests to the Sophos XG 85/105/115 firewall. The firewall have a vpn connection to the datacenter and want to send the request for the datacenter domain to the datacenter sophos xg firewall.

We have added the following entry: Network -> DNS: Name: xxx.local

      Target: xx.xx.xx.xx (ad/dc ip)

This forward is not working. Have you an idea what the problem is ?



This thread was automatically locked due to age.
Parents
  • 0
    To my knowledge it should only route thru the active tunnel route I have not tested this kind of setup with a failover but the XG should only consider the active tunnel route but option 1 you can define both your wan interfaces inside the tunnel networks but we need to make sure your dns server responds to the queries from the remote office wan ip addresses. Even if it's not there is a work around where in you can create a VPN to lan in your DC firewall with source being the remote wan ip s of your offices and destination being your dns server and snat all the wan IP address to the lan ip of the dc XG
  • 0 in reply to Kranthi

    on XG with SFOS 17.0.6 MR-6 would snatip from command line similar to what's described @ Sophos XG Firewall: How to allow branch office users to authenticate with the head office Active Directory Server be required when using dns request routing to send dns lookups for a domain to an internal dns server located across a RED interface link at another location?  There doesn't seem to be a RED equivalent of the ipsec_route command.

     

    update - answering my own question: yes, the snatip command in combination with any normal static routes to get traffic where it needs to go was required to make dns request routing to internal dns server at another location work across RED interfaces.  Examples where the first ip is the target dns server and the last ip is the lan interface of the local xg at the location where the dns request routing is configured:

     

    console> set advanced-firewall sys-traffic-nat add destination 10.20.0.1 snatip 192.168.202.1
    console> set advanced-firewall sys-traffic-nat add destination 10.20.0.2 snatip 192.168.202.1
    console> set advanced-firewall sys-traffic-nat add destination 10.20.0.3 snatip 192.168.202.1

Reply
  • 0 in reply to Kranthi

    on XG with SFOS 17.0.6 MR-6 would snatip from command line similar to what's described @ Sophos XG Firewall: How to allow branch office users to authenticate with the head office Active Directory Server be required when using dns request routing to send dns lookups for a domain to an internal dns server located across a RED interface link at another location?  There doesn't seem to be a RED equivalent of the ipsec_route command.

     

    update - answering my own question: yes, the snatip command in combination with any normal static routes to get traffic where it needs to go was required to make dns request routing to internal dns server at another location work across RED interfaces.  Examples where the first ip is the target dns server and the last ip is the lan interface of the local xg at the location where the dns request routing is configured:

     

    console> set advanced-firewall sys-traffic-nat add destination 10.20.0.1 snatip 192.168.202.1
    console> set advanced-firewall sys-traffic-nat add destination 10.20.0.2 snatip 192.168.202.1
    console> set advanced-firewall sys-traffic-nat add destination 10.20.0.3 snatip 192.168.202.1

Children
No Data