Hello Fellow Astaro Fans!
We have an Astaro ASG320 appliance (v8.309) configured with dual ISP connections.
- Cox Cable Modem is on Eth2
- Verizon FIOS is on Eth4
The connections are both used throughout the day in a randomized load balancing model. We have about 100 users on the internal network and when they are web browsing, they sometimes go out via Cox and sometimes go out via Verizon.
For about 1.5 years, this has worked great. As of 2 weeks ago, we've been getting a lot of people who cannot browse the web at all. Most web requests that seem to go out the FIOS pipe result in an Astaro error page that reads:
DNS resolution timeout
This does not make any sense because none of our user workstations utilize the DNS services of the Astaro. Instead, they all point to our internal Windows Active Directory DNS which then forwards to Google (8.8.8.8) and Level 3 (4.2.2.1) for FQDN's that it cannot resolve. Again, this has been fine for 1.5 years so I know it is not our setup.
The only way I can seem to fix this issue is by disabling the FIOS connection on Eth4. When I do that, the DNS resolution timeout goes away. I have done full integrity testing on the FIOS connection by plugging a PC directly into it (with no firewall/router in between) and it is fine. DNS requests to both Google and Level 3 come back fine (FIOS is not blocking DNS requests to these 3rd party servers) and the web browsing is fast (35 Mb/s up and down).
My suspiscion is something odd has started happening with Astaro's load balancing and I think the DNS is a red herring sort of error message.
Any thoughts? We are currently on just one ISP connectio (Cox) which is OK, but I'd like to get back to full redundancy ASAP. Sophos support suggested I send all DNS traffic requests via Cox, but that defeats my redundancy model (e.g. what happens if Cox goes down? People won't be able to fulfill DNS requests to the Internet).
I'm looking for a solution or confirmation that this is a bug somewhere in the Astaro system that will be resolved soon.
Many thanks!
This thread was automatically locked due to age.
