Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNS failed about 2 minutes after log out Captive Portal

Dear Sir,
I have created the VERIFY Zone (customize zone) to enable Captive portal authentication.

 

It works well at the first time.
User open web page and then redirect to Captive portal for login. 

But when user logout,
the dns resolution faile about 120 seconds, and new web page can't redirect to Captive portal.

After 120 seconds,
the dns works well suddenly, and the new web page can redirect to Captive portal.

I had try several times, and got the same result.
The dns only works after 120 seconds.

I got the following log between the 120 seconds.

2016-10-07 16:03:57 0110021 IP 10.16.2.102.61542 > 10.1.1.1.53 : proto UDP: packet len: 37 checksum : 50885
0x0000:  4500 0039 1438 0000 7f11 1005 0a10 0266  E..9.8.........f
0x0010:  0a01 0101 f066 0035 0025 c6c5 0085 0100  .....f.5.%......
0x0020:  0001 0000 0000 0000 0673 6875 6e7a 6504  .........shunze.
0x0030:  696e 666f 0000 1c00 01                   info.....
Date=2016-10-07 Time=16:03:57 log_id=0110021 log_type=Firewall log_component=Identity log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev=Port4 out_dev=Port1 inzone_id=8 outzone_id=1 source_mac=fc:f8:ae:10:7e:e9 dest_mac=00:1a:8c:5f:ae:71 l3_protocol=IP source_ip=10.16.2.102 dest_ip=10.1.1.1 l4_protocol=UDP source_port=61542 dest_port=53 fw_rule_id=102 policytype=1 live_userid=0 userid=65535 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=3760564194898870272 dn_classid=0 source_nat_id=0 cluster_node=0 inmark=0 nfqueue=0 scanflags=0 gateway_offset=0 max_session_bytes=0 drop_fix=0 ctflags=0 connid=8 masterid=298988416 status=0 state=256 sent_pkts=N/A recv_pkts=N/A sent_bytes=N/A recv_bytes=N/A tran_src_ip=N/A tran_src_port=N/A tran_dst_ip=N/A tran_dst_port=N/A

Is this a bug?
How should I fix it?

Shunze



This thread was automatically locked due to age.
Parents
  • Dear Sir,
    I have know how to make this situation happened.
    Enter the following command to make STAS work, the dns will fail for 120 second.
    system auth cta collector add collector-ip 172.16.16.1 collector-port 6677 create-new-collector-group

    After I remove this command, the DNS resolution works well.
    But our customer need STAS for SSO, so I can't remove this command.

    I have tested the procedure above on our lab,
    and it got the same result for dns failed about 120 seconds.

    This maybe a bug, is there anyone know how to fix it?

  • ShunzeLee,

    now it is clear why your DNS resolution fails for 120 seconds.

    Connect to XG using CLI, option 4 and then execute the following command:

    system auth cta unauth-traffic drop-period "seconds"

    XG advices to not set lower than 45 seconds.

    You can view the following settings issuing the following command:

    system auth cta show

    By default is 2 minutes.

Reply
  • ShunzeLee,

    now it is clear why your DNS resolution fails for 120 seconds.

    Connect to XG using CLI, option 4 and then execute the following command:

    system auth cta unauth-traffic drop-period "seconds"

    XG advices to not set lower than 45 seconds.

    You can view the following settings issuing the following command:

    system auth cta show

    By default is 2 minutes.

Children