0

I have had a Watchguard Firebox x55e since May w/o any issues. Upgraded to their new version 11 OS last Friday.

We have two DNS servers specified for the external interface and have it handling DHCP.

Yesterday morning it started issuing 192.168.137.1 as the primary DNS server and no secondary. That IP address is not only not one of the DNS servers we use but it's also not a machine in our network nor our internal IP range.

If you release and renew the IPs in Windows it will go back and forth from receiving the incorrect DNS server to correct ones.

Everything else is getting set properly via DHCP all the time. This is effecting several desktops and laptops on our network.

I'm in queue for support from Watchguard but they take forever.

2
  • I ruled out the possibility of it being an rouge DHCP server, FYI.
    – Charles
    Sep 2, 2009 at 17:10
  • Maybe it's a green one? SCNR Sep 17, 2009 at 10:21

2 Answers 2

1

You may have a rogue DHCP server on your network if it is switching back and forth like that. When one of your PCs pulls the wrong info, can you confirm the DHCP lease time in the firebox at all? (I don't use one so I don't know). You can do a packet sniff with Wireshark while releasing/renewing the DHCP on one of your PCs and confirm where it is actually receiving the DHCP lease from to be sure it is coming from the firebox.

Do you have multiple scopes set up on the firebox and could the PC be pulling from the other scope? I would think not especially if the DNS server is nothing you have ever used before. If not, are you in a hosted facility with multiple customers? Maybe the hosting provider messed up and somehow included your network with another customer's VLAN and you are grabbing from their DHCP server.

I would first confirm with a packet sniff where the PC is getting its lease from and also double-check on the firebox that it is indeed the device handing out the lease. If it is then it may be something to do with the firebox config itself and the upgrade? If it is not handing it out then you can track down the rogue DHCP box with the packet sniff.

Edit:

Seeing that you have ruled out the rogue DHCP option...Is it possible to get a running config printout of the firebox and search for that IP in the config somewhere? If you are 100% sure the firebox is handing out that IP, then it must be in the config somewhere...

2
  • I can confirm the DHCP is in the Firebox for a machine getting the wrong DNS server. I can also confirm that Windows lists the Firebox as the DHCP server. I cannot find an instance of 192.168.137 anywhere in the config file for the Firebox.
    – Charles
    Sep 2, 2009 at 17:42
  • I mean the DHCP lease is in the Firebox for the machine getting the incorrect DNS server.
    – Charles
    Sep 2, 2009 at 17:43
0

Have you rebooted the firebox?

What do you mean you have DNS server configured on the external interface? Do you mean that they're configured as related hosts on the external interface? I'm using an older model firebox so I amy not be seeing all of the options that you are.

Also, have you considered moving DHCP to an internal server?

2
  • I have rebooted the firebox a couple times. I miss-wrote that statement. What I meant was I have two IP addresses specified as DNS servers on the firebox. We are in fact going to have an internal DHCP server but for the time being the Firebox needs to be doing it. I ruled out the possibility of it being an rouge DHCP server, FYI.
    – Charles
    Sep 2, 2009 at 17:07
  • I find our firebox gets flaky sometimes. Try re-saving the config file to the firebox and see if ot helps.
    – joeqwerty
    Sep 2, 2009 at 17:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .