Zywall 110 extrange behavior with subdomain

jaalsa
jaalsa Posts: 3  Freshman Member
First Comment
in Security

Hello,

The firewall is running V4.73(AAAA.2).

We have a domain (example.es), with the appropiate DNS entries configured at our registrar for our website:

IN A example.es x.x.x.x

IN A www.example.es x.x.x.x

The issue is that in the office, we have some virtual machines (running behind a proxy) for which we want to use subdomains of the company's domain: vm1.dev.example.es, and so on.

So we created CNAMES in the Zywall DNS configuration pointing to the local A entry for the server where those vms are:

vm1.dev.example.es CNAME devsrv.company.local

(The firewall domain is configured as example.local)

These CNAMES are working great, but they are, for some reasong, rendering the zywall unable to resolve "example.es". If the delete the CNAME, the zywall is then again able to resolve "example.es".

Some pictures are attached with the actual configuration, real domain and DNS queries results made from the zywall.

CNAME and dns lookup with cname:

image.png
image.png

It's like the zywall is stating that iself is the authoritative server for the "example.es" (aa flag) ant it's saying it doesn't exist. I don't understand why.

No CNAME and dns query from the zywall (no aa for example.es this time):

image.png

Thanks!

Accepted Solution

  • Zyxel_Judy
    Zyxel_Judy Posts: 1,643  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    Answer ✓

    Hi @jaalsa ,

    System will have such DNS zone file when you have kind of CNAME record, so you are right firewall act as NS itself this time. So, you can try to add an A record for "aptica.es" A 79.139.120.30 in GUI as workaround. 

    Please be aware that the Zywall 110 model has reached its End of Life (EOL) status, which means our support for this model will be limited. For information on alternative options, you also can refer to the available models:

    Next-Gen Firewall | Zyxel Networks

    Judy

    Untitled Image

    See how you've made an impact in Zyxel Community this year! https://bit.ly/Your2024Moments_Community

All Replies

  • Zyxel_Judy
    Zyxel_Judy Posts: 1,643  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    Answer ✓

    Hi @jaalsa ,

    System will have such DNS zone file when you have kind of CNAME record, so you are right firewall act as NS itself this time. So, you can try to add an A record for "aptica.es" A 79.139.120.30 in GUI as workaround. 

    Please be aware that the Zywall 110 model has reached its End of Life (EOL) status, which means our support for this model will be limited. For information on alternative options, you also can refer to the available models:

    Next-Gen Firewall | Zyxel Networks

    Judy

    Untitled Image

    See how you've made an impact in Zyxel Community this year! https://bit.ly/Your2024Moments_Community

  • jaalsa
    jaalsa Posts: 3  Freshman Member
    First Comment
    edited November 4

    Thank you very much.

    I have tested too removing the CNAME and creating a
    x.dev.aptica.es IN A internal_ip

    And the same happens, the firewall puts itself as authoritative over aptica.es.

    We have implemented the suggested workaround successfully. Thanks.

    I'd like to ask: is this because of the zywall's dns implementation? We are considering upgrading the zywall to a newer one, is this issue resolved on them?

    Thanks!

  • Zyxel_Judy
    Zyxel_Judy Posts: 1,643  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula

    Hi @jaalsa ,

    This is the current DNS implementation across all Zyxel firewalls. Please use our suggested solution to meet your requirements.

    Judy

    Untitled Image

    See how you've made an impact in Zyxel Community this year! https://bit.ly/Your2024Moments_Community

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）