This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNS "Host not found" problem on uplink saturation

Hello,
this is a problem which randomly appears and I've never been able to track it fully down or get rid of it.
I've got three different UTM installations (two appliances, one VM), all 9.3x, where we get "host not found" and/or very slow connection speed as soon as a big, long lasting upload happens. Our DNS is configured according to the "DNS best practice": Clients -> Internal DC/DNS -> UTM -> Google public DNS;
This is happening on asymmetric ADSL Lines (down 8 MBit, up 400-600 kBit), it doesn't happen on HDSL configurations with more than 1 MBit uplink.
We've tried with and without QoS and fine-tuning of the corresponding interface configurations (LAN and WAN) with no success.
Even if we manually limit the uplink speed client-side to about 300 kBit per upload, the problem persists.
What could be wrong in our setups?

Best regards,
TP

This thread was automatically locked due to age.

Parents

0 BAlfson over 10 years ago

Yes, TP and DK, put a Bandwidth Pool on the External interface guaranteeing 10kbps to 'Any -> DNS -> Internet'.

William, several years ago, due to issues with QoS, I started not selecting 'Upload Optimizer' when any Bandwidth Pool was on an interface. Likewise, the 'Download Equalizer' and Download Throttling rules. I haven't revisited that in awhile - are you saying that those automatic selections no longer cause conflicts with manually-created rules?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 10 years ago in reply to BAlfson

Yes, TP and DK, put a Bandwidth Pool on the External interface guaranteeing 10kbps to 'Any -> DNS -> Internet'.

William, several years ago, due to issues with QoS, I started not selecting 'Upload Optimizer' when any Bandwidth Pool was on an interface. Likewise, the 'Download Equalizer' and Download Throttling rules. I haven't revisited that in awhile - are you saying that those automatic selections no longer cause conflicts with manually-created rules?

Cheers - Bob

I use those along with custom rules and they work fine. QOS just like then takes proper tuning and accurate real-time measurements of your ACTUAL throughput not what the isp is saying you are getting. Dsl lines are notorious(deservedly so) of being unstable so you have to run multiple measurements and use the LOWEST measured speed to ensure proper setup. Comcast is the best on the cable side for stability and actually reaching their provisioning...most cable providers are really good...dsl and other phone line based technologies(or wifi is actually worse) can be a challenge.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 William Warren over 10 years ago in reply to BAlfson

Yes, TP and DK, put a Bandwidth Pool on the External interface guaranteeing 10kbps to 'Any -> DNS -> Internet'.

William, several years ago, due to issues with QoS, I started not selecting 'Upload Optimizer' when any Bandwidth Pool was on an interface. Likewise, the 'Download Equalizer' and Download Throttling rules. I haven't revisited that in awhile - are you saying that those automatic selections no longer cause conflicts with manually-created rules?

Cheers - Bob

I use those along with custom rules and they work fine. QOS just like then takes proper tuning and accurate real-time measurements of your ACTUAL throughput not what the isp is saying you are getting. Dsl lines are notorious(deservedly so) of being unstable so you have to run multiple measurements and use the LOWEST measured speed to ensure proper setup. Comcast is the best on the cable side for stability and actually reaching their provisioning...most cable providers are really good...dsl and other phone line based technologies(or wifi is actually worse) can be a challenge.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data

DNS "Host not found" problem on uplink saturation

Submitted a Tech Support Case lately from the Support Portal?