USG Flex 200 DNS cache poisoning?

Fr0ns

Hello,

Our USG Flex 200 is working just fine for clients. The device itself will not connect to the internet however. I cannot search for updates and timesync does not work for example. Using SSH to check on the machine locally the following happens:

Router> ping gmail.com

PING gmail.com (192.168.50.41) 56(84) bytes of data.

--- gmail.com ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2003ms

Strangely, when flushing the DNS cache and querying again straight afterwards:

Router> ip dns server cache-flush
server reload successful
Router> ping gmail.com
PING gmail.com (142.250.179.197) 56(84) bytes of data.
64 bytes from 142.250.179.197: icmp_seq=1 ttl=118 time=15.0 ms
64 bytes from 142.250.179.197: icmp_seq=2 ttl=118 time=14.5 ms
64 bytes from 142.250.179.197: icmp_seq=3 ttl=118 time=13.7 ms

--- gmail.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 13.788/14.459/15.041/0.533 ms

Waiting a few minutes after this and trying again:

Router> ping gmail.com
PING gmail.com (192.168.50.41) 56(84) bytes of data.

--- gmail.com ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2008ms

Machine has been rebooted, runs firmware V5.38(ABUI.0). DNS forwarders are to our ISP but changing those to 8.8.8.8 for example shows the same behaviour. We do not use the 192.168.50.x subnet, never have and never will.

PeterUK

That is odd what happens if you nslookup from a PC to Zywall for gmail.com ?

If you just connect one PC directly to to the USG does the problem happen?

If you do a cache-flush then packet capture WAN for port 53 and do ping gmail.com and shows wrong what does the packet capture show ?

Fr0ns

No, this is from de Flex200 itself over SSH.

We've narrowed this down to being a USB 4G internet dongle connected to the same Flex 200 which oddly is in the 192.168.0.x/24 range but oddly enough when disconnected the problems stop.