d.nebula.zyxel.com DNS resolve shows different results then it tries to connect
Hello Community,
My AP tries every minute to reach one of the two AWS Servers that are not listed in d.nebula.zyxel.com and is blocked.
i followed the connectivity settings on your KB: Knowledge Base | Zyxel.
TCP Port 6667 and 4335 fpr d.nebula.zyxel.com are allowed on the Firewall.
Do i need to allow 443? Its noted that KB, that this port is used by users not by the AP himself to connect to the NCC.
Now i have the following problem:
For the name d.nebula.zyxel.com i get the Resolve:
My AP tries every minute to reach one of the two AWS Servers that are not listed in d.nebula.zyxel.com and is blocked.
i followed the connectivity settings on your KB: Knowledge Base | Zyxel.
TCP Port 6667 and 4335 fpr d.nebula.zyxel.com are allowed on the Firewall.
Do i need to allow 443? Its noted that KB, that this port is used by users not by the AP himself to connect to the NCC.
Now i have the following problem:
For the name d.nebula.zyxel.com i get the Resolve:
52.16.90.243
52.210.229.217
52.48.115.44
54.76.217.223
54.73.103.137
34.243.116.158
52.210.12.1
34.246.20.161
But if i check the firewall it says it tries to connect to:
54.174.230.238
52.207.42.20
(with 443 SSL) and denys it.
Im from Europe/Austria, is it possible that something is wrong here with the AWS DNS entrys?
Did i miss something on my side? Can you please help me?
But if i check the firewall it says it tries to connect to:
54.174.230.238
52.207.42.20
(with 443 SSL) and denys it.
Im from Europe/Austria, is it possible that something is wrong here with the AWS DNS entrys?
Did i miss something on my side? Can you please help me?
0
All Replies
-
Hi there,
Except d.nebula.zyxel.com, there are other service such as s.nebula.zyxel.com or firmware.nebula.zyxel.com, etc. You can try to resolve these domains to check whether they are the two AWS Servers that are not listed in.
Besides, some service uses dynamic IP addresses, so the resolve you get might be not the same at every time.
We recommend you do the security policy based on the domains not the IP address to avoid some service will be blocked/ denied.
0 -
Hello thank you for your reply,
i changed the rules on the Firewall like you suggested but the Problem is still the same.
on the firewall these are now allowed:
d.nebula.zyxel.com
s.nebula.zyxel.com
d-a.nebula.zyxel.com
d-cp.nebula.zyxel.com
d-mp.nebula.zyxel.com
the Problem is still the same: the Access Points try to connect with Port 443 to the IPs
54.174.230.238
52.207.42.20
and are denied because these two IPs are not resolved in these Names.
Should i add these two IP-Adresses to the rule or is there a problems with the DNS resolve?0
Categories
- All Categories
- 415 Beta Program
- 2.4K Nebula
- 152 Nebula Ideas
- 100 Nebula Status and Incidents
- 5.8K Security
- 290 USG FLEX H Series
- 278 Security Ideas
- 1.5K Switch
- 77 Switch Ideas
- 1.1K Wireless
- 42 Wireless Ideas
- 6.5K Consumer Product
- 252 Service & License
- 396 News and Release
- 85 Security Advisories
- 29 Education Center
- 10 [Campaign] Zyxel Network Detective
- 3.6K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 86 About Community
- 75 Security Highlight