- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Reverse DNS query doesn't work on Meraki
Hello friends.
We are having a weird issue in our organization and have not found a solution for it yet.
I have DNS server on-prem and on Azure. If a client within the same subnet that DNS servers reside on send a request for reverse, it will work perfectly but all other clients on different subnets or from different routed network on SDWAN Meraki Auto VPN won't be able to get a respond for reverse dns. The forward records are resolved with no issues. We have rebuilt the reverse Zone on DNS and have done a lot of investigation with Meraki support as well but had no chance to find the root cause. we have no rules on MX to kill this traffic but when I did packet capture on a client and dns server I noticed the forward dns queries has a complete communication but the reverse query get lost on Sever end.
Any recommendation will be appreciated.
Solved! Go to solution.
- Labels:
-
Firewall
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You added your reverse lookup zones for your internal IP subnets also (i.e. 168.192.in-addr.arpa)? Just wanted to make sure.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are the clients on different subnets using the same DNS server for resolution? Or are their DNS settings pointed to different DNS servers? Hard to understand from your post if all clients are using the same or different DNS servers?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes, all clients are using the same set of servers for DNS.
I have a few DNS servers on-prem and on Azure for HA and all clients are using those servers across the org. Also database for all those DNS servers are synced and they all has the same setup.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try this one case study
https://community.meraki.com/t5/Wireless/Weird-DNS-Issues/td-p/5352
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this does not apply to our case.
Thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you happen to have Umbrella Protection enabled in your MX Threat Protection settings?
We experienced a similar problem a couple of years ago and ultimately figured out that we needed to add our internal reverse lookup zones to the exclusion list to keep reverse queries from being routed to Umbrella.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have already added my domain to excluded from being routed to Cisco Umbrella section in threat protection.
Thanks for the comment
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You added your reverse lookup zones for your internal IP subnets also (i.e. 168.192.in-addr.arpa)? Just wanted to make sure.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this was what we missed in Umbrella exclusion.
I had the domain names in the setting but the reverse zones were missing.
Thank you so much for the help.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad it worked for you.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does changing the Traffic Analytics settings (under Network-Wide/General) make any difference to the issue?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what else can be done?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I made changes like disabling/ adding my domain/ adding IP range for my LAN.
none of them helped.
