4

I am hoping someone can shed some light on this one...

I have two Windows 2003 DC's - both running DNS, there are several Windows 2008 R2 and one Windows 2012 Standard server running as member servers - they are all on the same subnet.

Until today, we had no issues with resolving internet addresses via these systems.

SonicWall NSA240 is the firewall.


  • Earlier today I was browsing the internet, no issues at all. I accidentally configured a VM with the same IP address as the firewall (missed out a digit). This was resolved quickly. No changes were made to the firewall.

  • Soon after this I tried to browse a site and found that I couldn't

  • I bounced on to both DC's and tried to resolve internet IPs - neither worked

  • pinging internet addresses also fails

  • running tests from the firewall is successful - I can complete DNS resolution and ping tests

This led me to believe that the problem was internal - but nothing in relation to DNS has been changed.

However, not being able to ping internet IP addresses leads me to the Firewall.

DNS setup as follows on both DCs:

  • DNS forwarders to 8.8.8.8 and 8.8.4.4. plus two ISP DNS servers
  • Root hints are showing correctly on both systems
  • Both servers are configured identically - both servers fail recursive DNS test
  • Both server cannot ping external addresses (and neither can any device on network)

I have been scratching my head for a while now - all suggestions welcome!

19
  • 1
    Having a VM with the same ip address as the firewall means that some internal clients may have cached the MAC address for the VM when trying to ARP resolve the ip address of the firewall, which would explain the behavior you're seeing BUT I would have expected the ARP cache on your Windows machines to have expired by now and to have flushed that MAC address. Nevertheless it's worth a look. What do you see if you ping the ip address of the firewall from a Windows machine and then view the ARP cache on that machine? Is the firewall's ip address resolving to the correct MAC address?
    – joeqwerty
    Jan 2, 2015 at 17:44
  • Also, assuming you're using managed switches, what port is the MAC address of the firewall registered to in the switches MAC address table? Is it correct?
    – joeqwerty
    Jan 2, 2015 at 17:46
  • The ARP cache is showing the MAC address of the firewall. Thanks for the quick suggestion.
    – Ken
    Jan 2, 2015 at 18:05
  • I should also add that I see the DNS query being passed by the firewall e.g. 17:56:36 Jan 02 602 Network Debug DNS packet allowed 8.8.8.8, 53, X3 FIREWALLIP, 49153, X3 udp.
    – Ken
    Jan 2, 2015 at 18:38
  • I would focus on one problem at a time. Ping failures imply a general connectivity issue. Name resolution failures imply a DNS issue. I would tackle the ping issue first. Can you ping from a client to the firewall? If so, can you ping from a client to 8.8.8.8 or 8.8.4.4?
    – joeqwerty
    Jan 2, 2015 at 18:44

1 Answer 1

2

Resolved - Sonicwall service policy entry included a HTTPS Management rule - this created a mismatch and the device disabled permitted LAN -> WAN services and protocols.... was only whilst I was onsite that I was able to see exactly what was going on.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .