Zywall 310 can not reach public dns itself System/DNS??

KMP
KMP Posts: 17  Freshman Member
First Comment Friend Collector Second Anniversary
edited April 2021 in Security
Hi we have a Zywall 310 running the latest firmware 4.62(AAAB.0)

The device itself can not reach public internet, for example i would like to upgrade the security IDP services, but it seems the device can not reacht the license server (portal.zyxel.com)

I have tried setting de System/DNS settings to 8.8.8.8 and tried without. 

When running diagnostics and opening nslookupv4 it won't reach dns servers.

What could be the problem? Our infrastructure behind the Zywall will reach internet fine. No problems.

All Replies

  • PeterUK
    PeterUK Posts: 3,461  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited February 2021

    Do you have a external interface to the internet?

    do you have a bridge setup?

    From the Zywall diagnostics use TRACEROUTE IPv4 to 8.8.8.8 and see what you get.


  • KMP
    KMP Posts: 17  Freshman Member
    First Comment Friend Collector Second Anniversary
    Hi PeterUK,

    Yes, an external interface is connected: ISP Fiber -> BaseT switch.
    IPoE setup on WAN2 interface of Zywall with fixed IP.

    A traceroute. It seems it does route via the ISP gateway. Then at hob 30 it stops.


  • KMP
    KMP Posts: 17  Freshman Member
    First Comment Friend Collector Second Anniversary
    No Bridge setup.
  • PeterUK
    PeterUK Posts: 3,461  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited February 2021

    So do you SNAT on a single WAN IP or do you have a subnet of WAN IP's?


  • KMP
    KMP Posts: 17  Freshman Member
    First Comment Friend Collector Second Anniversary
    Hi, Yes we do SNAT on multiple WAN IP's. Using policy route

  • PeterUK
    PeterUK Posts: 3,461  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary

    But have you tried SNAT the WAN IP the interface is on not your other WAN IP's by outgoing-interface ? I think the issue is you can't use that IP for internet and the Zywall is trying that IP and fails.

    My setup has some what the same problem but different so what I think might work is if you make another port external zone OPT with a IP of the of your LAN subnet to its gateway connect it to your switch for that LAN so that it becomes a client and SNAT out your set WAN IP then setup a trunk with that interface at the top. If this works like I hope the Zywall will use that interface to make connections for DNS and such.


  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,251  Zyxel Employee
    100 Answers 500 Comments Friend Collector Fourth Anniversary

    Hi @KMP

    Could you provide your startup-config file to us for further investigation?

    Thanks.



    Untitled Image

    See how you've made an impact in Zyxel Community this year! https://bit.ly/Your2024Moments_Community

  • KMP
    KMP Posts: 17  Freshman Member
    First Comment Friend Collector Second Anniversary
    Hi Jeff, I have provided you the conf file in a pm. 

    Thanks

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）