How long do WILDCARD FQDN last for if not updated?

PeterUK

I have 128 WILDCARD FQDN in one group plus another group I do have most of  them one by one for testing but the same thing should happen if I first load up other sites first then https://www.twitch.tv/twit

I try a reboot of the USG and load https://www.twitch.tv/twit first with the group and see what happens  

my IPv4 FQDN Object Cache List is over 400 listed.

PeterUK

Did a reboot with the groups of sites and loaded https://www.twitch.tv/twit first watched the TTL for the stream IP go to 0 some minutes later the stream drops out so I send you the config.  

PeterUK

I also did a test and reboot with just the following enabled for Twitch

*jtvnw.net

*imworldwide.com

*twitchsvc.net

*twitchcdn.net

*twitch.tv

*ttvnw.net

*gstatic.com

*google.co.uk

*google.com

*amazon-adsystem.com

Same thing happened took about 10 minutes after TTL went to 0 and then the IP listed disappeared.

I also noted that in IPv4 FQDN Object Cache List was showing my other sites that are not enabled? Is that mean to happen?

Zyxel_Stanley

Hi @PeterUK

We are analyzing the symptom during FQDN DNS TTL timeout.

PeterUK

So their was a fix for this "session-status-update zyfilter inactive" would like a update when or if it be in released for USG/VPN/Zywall ? 

Thanks

Zyxel_Stanley

Hi @PeterUK

The fix firmware we provided to you has changed behavior for keep exist session even the policy control rule has been changed.

(After FQDN TTL countdown to 0, then system will release IP from policy control function, then system will disconnect all of exist session for security reason)

Since this changing is only for specific scenario, so we decided do not leverage it into official version.

PeterUK

But its needed say I want to BWM ttvnw_net so that streaming video gets Guaranteed Bandwidth when the TTL goes to 0 and then is removed the session goes to low priority.

A option that keeps the FQDN in the list after TTL goes to 0 for x hours would help.

PeterUK

Zyxel_Stanley said:

(After FQDN TTL countdown to 0, then system will release IP from policy control function, then system will disconnect all of exist session for security reason)

Zyxel_Stanley
Their is no security reason if it was done so that the IPv4 FQDN Object Cache List for listed IP with TTL 0 just stay listed for x hours there is no harm in doing this.

I'm asking to extend the IP Cache List locally by x hours 

Please rethink this.

PeterUK

I have done a test showing the problem if a workaround is not done

firewall rules

LAN1 to WAN - DNS allow

LAN1 to WAN - HTTP destination FQDN *.ddns.net - allow

LAN1 to WAN - HTTP - deny

Go

http://dnsip1.ddns.net/FQDN%20test.html

And click the click here then wait 5 minutes before clicking the link to which you get no page loaded if you click the link without waiting you get page with loaded.

Zyxel_Stanley

Hi @PeterUK

it will have side effect if keep DNS record for additional house:

In most scenarios, the FQDN server are using dynamic IP address. If change behavior to keep old IP address for additional hours, then will have connection fail after server changing to new address.

The enhancement is included in the forum release but will not in official version.