3

The issue that I am facing is the following:

I have configured a vm Ubuntu and the machine isn't able to resolve DNS records with my internal DNS server. "The DNS server is a windows_server_2008_R2 AD/DNS combo"

The topology: Topology

Ubuntu configuration:

root@rboshmaf-ubuntu:~# cat /etc/network/interfaces

interfaces(5) file used by ifup(8) and ifdown(8)
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
          address 192.168.1.12
          netmask 255.255.255.0
          dns-nameservers 172.16.1.11 144.254.71.184
          gateway 192.168.1.1



root@rboshmaf-ubuntu:~# route

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
link-local      *               255.255.0.0     U     1000   0        0 eth0
192.168.1.0     *               255.255.255.0   U     0      0        0 eth0



root@rboshmaf-ubuntu:~# cat /etc/resolv.conf

Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 172.16.1.11
nameserver 144.254.71.184

The vm wimdows_7 machine that is in the same network as the Ubuntu "using the same DNS server" is able to get the results.

ASA configuration "traffic going from high > low security, required inspection is in place"

Took captures on the ASA to see what is happening, the weird thing that I saw was the fact that in Ubuntu "not working situation" the query is going to 1.1.168.192.in-addr.arpa ubuntu_cap
In windows "working situation" the query is going to 1.1.16.172.in-addr.arpa windows_cap

keep in mind that the windows server IP is 172.16.1.11 and the DNS records are all there dns_config_windows

ping\nslookup from windows_7

C:\Users\administrator>ping 172.16.1.11
Pinging 172.16.1.11 with 32 bytes of data:
Reply from 172.16.1.11: bytes=32 time=1ms TTL=128

Ping statistics for 172.16.1.11:
    Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 1ms, Average = 1ms
Control-C
^C

C:\Users\administrator>nslookup rboshmaf-ubuntu 172.16.1.11

Server:  win-o33saf37ksq.raedlab.local

Address:  172.16.1.11

Name:    rboshmaf-ubuntu.raedlab.local

Address:  192.168.1.12

ping\nslookup fom Ubuntu

root@rboshmaf-ubuntu:~# ping 172.16.1.11
PING 172.16.1.11 (172.16.1.11) 56(84) bytes of data.
64 bytes from 172.16.1.11: icmp_seq=1 ttl=128 time=1.25 ms
^C
--- 172.16.1.11 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.258/1.258/1.258/0.000 ms

root@rboshmaf-ubuntu:~# nslookup rboshmaf-ubuntu 172.16.1.11
Server:         172.16.1.11
Address:        172.16.1.11#53

** server can't find rboshmaf-ubuntu: SERVFAIL

What I don't like in the capture is the fact that Ubuntu query is going to 1.1.168.192.in-addr.arpa which isn't the DNS server "in fact 192.168.1.1 is the GW for Ubuntu "inside interface of the ASA"

Any ideas or suggestion about the situation.

Thanks!

edit #1

Just to remove the ASA from the picture, I reconfigured the Topology as following:

new_topology

New Ubuntu configuration:

   root@rboshmaf-ubuntu:~# cat /etc/network/interfaces 
     # interfaces(5) file used by ifup(8) and ifdown(8)
     auto lo
     iface lo inet loopback
     auto eth0
     iface eth0 inet static
           address 172.16.1.12
           netmask 255.255.255.0
           dns-nameservers 172.16.1.11 144.254.71.184
           gateway 172.16.1.1

   root@rboshmaf-ubuntu:~# ifconfig
   eth0      Link encap:Ethernet  HWaddr 00:50:56:99:3c:b3  
             inet addr:172.16.1.12  Bcast:172.16.1.255  Mask:255.255.255.0
             UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
             RX packets:20756 errors:0 dropped:0 overruns:0 frame:0
             TX packets:6959 errors:0 dropped:0 overruns:0 carrier:0
             collisions:0 txqueuelen:1000 
             RX bytes:29614255 (29.6 MB)  TX bytes:480744 (480.7 KB)

   root@rboshmaf-ubuntu:~# cat /etc/resolv.conf 
   # Dynamic resolv.conf(5) file for glibc resolver(3) generated by 
   resolvconf(8)
   #     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
   nameserver 172.16.1.11
   nameserver 144.254.71.184

   root@rboshmaf-ubuntu:~# route
   Kernel IP routing table
   Destination     Gateway         Genmask         Flags Metric Ref    Use 
   Iface
   default         172.16.1.1      0.0.0.0         UG    0      0        0 
   eth0
   link-local      *               255.255.0.0     U     1000   0        0 
   eth0
   172.16.1.0      *               255.255.255.0   U     0      0        0 
   eth0

ping/nslookup from Ubuntu

root@rboshmaf-ubuntu:~# ping 172.16.1.11
PING 172.16.1.11 (172.16.1.11) 56(84) bytes of data.
64 bytes from 172.16.1.11: icmp_seq=1 ttl=128 time=1.23 ms
64 bytes from 172.16.1.11: icmp_seq=2 ttl=128 time=0.811 ms
64 bytes from 172.16.1.11: icmp_seq=3 ttl=128 time=0.981 ms
^C
--- 172.16.1.11 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2001ms
rtt min/avg/max/mdev = 0.811/1.007/1.231/0.176 ms
root@rboshmaf-ubuntu:~# nslookup rboshmaf-ubuntu 172.16.1.11
Server:     172.16.1.11
Address:    172.16.1.11#53

** server can't find rboshmaf-ubuntu: SERVFAIL

capture for the ASA confirming no traffic reached the ASA

rboshmaf-asa# capture cap1 interface dmz match ip h 172.16.1.12 h 172.16.1.11
rboshmaf-asa# show capture
capture cap1 type raw-data interface dmz [Capturing - 0 bytes]
  match ip host 172.16.1.12 host 172.16.1.11

And I took tcpdump on ubuntu

root@rboshmaf-ubuntu:~# tcpdump -n -i eth0 | grep 172.16.1.11.53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
10:17:07.417553 IP 172.16.1.12.54685 > 172.16.1.11.53: 43282+ A? rboshmaf-ubuntu. (33)
10:17:07.418939 IP 172.16.1.11.53 > 172.16.1.12.54685: 43282 ServFail 0/0/0 (33)
10:17:27.270067 IP 172.16.1.12.56675 > 172.16.1.11.53: 50648+ A? ntp.ubuntu.com. (32)
10:17:27.270803 IP 172.16.1.11.53 > 172.16.1.12.56675: 50648 3/0/0 A 91.189.89.198, A 91.189.89.199, A 91.189.91.157 (80)

And the local capture from the windows_servernew_capture

Thanks!

2 Answers 2

1

My guesses are:

  1. DNS server isn't accepting requests on port 53. Try using telnet on port 53 to test this.
  2. If the flows are ok, please check your /etc/hosts from Ubuntu, might have a local record which might create a conflict.
  3. If the above doesn't give you an answer, maybe there is something wrong with the configuration of DNS server. Make sure you have the A record provisioned as well as a NS record for authority.
7
  • The Ubuntu machine is back behind the inside interface of the ASA and it has it's 192.168.1.12 IP
    – rboshmaf
    Aug 3, 2017 at 16:34
  • 1. Telnet is working "If the server is returning results most likely the connections are happening don't you think" root@rboshmaf-ubuntu:~# telnet 172.16.1.11 53 Trying 172.16.1.11... Connected to 172.16.1.11. Escape character is '^]'.
    – rboshmaf
    Aug 3, 2017 at 16:37
  • 2. Here is the local hosts root@rboshmaf-ubuntu:~# cat /etc/hosts 127.0.0.1 localhost # The following lines are desirable for IPv6 capable hosts ::1 ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters
    – rboshmaf
    Aug 3, 2017 at 16:42
  • 3. I am pretty sure DNS is configured correctly, you can check it from the screenshot above. Also how can you explain the fact that DNS is working for windows and not Ubuntu to be an issue from the DNS server and not the Ubuntu client "if you check the Ubuntu query that is listed above you will see that it is weird"
    – rboshmaf
    Aug 3, 2017 at 16:44
  • Can you try nslookup with the FQDN rather than the shortname? From the Ubuntu machine. Aug 4, 2017 at 7:24
0

The issue was that the machine didn't know what FQDN to search in, I edited /etc/network/interfaces to include "dns-search raedlab.local"

rboshmaf@rboshmaf-ubuntu:~$ cat /etc/network/interfaces
# interfaces(5) file used by ifup(8) and ifdown(8)
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
      address 192.168.1.12
      netmask 255.255.255.0
      dns-nameservers 172.16.1.11 144.254.71.184
      gateway 192.168.1.1
      dns-search raedlab.local < this was missing in my configuration

rboshmaf@rboshmaf-ubuntu:~$ nslookup rboshmaf-ubuntu 172.16.1.11
Server:     172.16.1.11
Address:    172.16.1.11#53

Name:   rboshmaf-ubuntu.raedlab.local
Address: 192.168.1.12

Also you can check this post on askubuntu for information about what dns-search does What does the dns-search option mean in /etc/network/interfaces?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .