1

I have 2 UDM Pro firewalls setup with a IPsec site to site VPN, the settings are the same for both VPNs (obviously the destination IPs are reversed for each unit) I can ping traffic with IP addresses both directions. I am unable to ping any host names or FQDNs. I cannot connect to the domain, or deal with any domain services like network drives, password resets etc. Below is the current configuration and testing I have done:

Site A is 192.168.1.1/24 (UDM running DHCP for local network)

  • Has about 25 previously domain connected PCs from Site B that were moved to the new office and need to be able to see Site B's server for Login Auth, Network Drive, adding new PCs to domain when the office grows etc.

Site B is 192.168.254.253/24 (UDM's DHCP is off in favor of onsite server running DHCP)

  • 192.168.254.105 (Windows 2012 Domain Controller running DHCP/WINS, AD/DS, DNS for primary site, domain example is corporate.insertmyclienthere.com)
  • 192.168.254.19 (NAS/Share Drive)

Able to do:

  • Computers on Site A can ping Site B's server IP address no problem, and vice versa, the server can also ping that machine. e.g. ping 192.168.254.105
  • Can see and login to network share with domain credentials by visiting 192.168.254.19
  • Can ping both gateways from a pc on each site

Unable to do:

  • Cannot Ping Host Name e.g. ping np-dc1
  • Cannot Ping FDQN e.g. np-dc1.corporate.insertmyclienthere.com
  • Cannot Connect PC to domain A domain controller is unavailable
  • Cannot reset password from domain controller and have it reflect on Site B PCs
  • Cannot Login as a user that hasn't previously logged in
  • Cannot find network share by visiting share name \\nphv3

Tested:

  • Disabled windows firewalls on both end to verify nothing was being blocked locally
  • Disabled all IPS/Security functions
  • Manually Added 192.168.254.105 to DNS on the machine at site A, and made sure to ipconfig /flushdns with no actionable results
  • Manually adding host names to the hosts file allows for resolution to the network drives via sharename but not to domain functions.
  • Note: The previously replaced firewalls (which were older watchguard models, limited to 10/100 speeds) had no issue with this translation of data and could handle these requests, we upgraded recently to the UDM pro's for the extra throughput; to allow our new office to utilize it's new internet speeds.

DHCP on the server has both routers listed, and the DHCP on the UDM at Site A has the server 192.168.254.105 listed as the DNS/WINS issuing server

VPN Settings:

  • Manual IPsec
  • Enabled
  • Remote Subnet: 192.168.254.0/24 (reversed on the other device)
  • Route distance: 30
  • Interface: WAN
  • Key Version: IKEv2
  • Encryption: AES-256
  • Hash: SHA1
  • IKE DH Group: 14
  • ESP DH Group: 14
  • Perfect Forward Secrecy: On
  • Dynamic Routing: On

For obvious reasons I wont provide the Pre-Shared Key / Public IPs

fboaventura
  • 1,135
  • 11
  • 16
David
  • 11
  • 3
  • Can you check if DNS requests are being sent/replied from/to both sides? This seems to be a DNS issue, more than a network related one. – fboaventura May 26 '21 at 11:45
  • DNS cannot be accessed by Site A, but is available for Site B. I believe its an issue with the firewall or a setting / drop request, as I can swap to the Fireguard Firewall with the same static information and get DNS requests. I'm curious if I need to open specific ports for DNS on the UDM or no? – David May 26 '21 at 12:00
  • You will need port `53 udp/tcp` open so your clients can query the DNS server. – fboaventura May 26 '21 at 12:06

1 Answers1

0

So, you seem to have a DNS issue. One side of the VPN doesn't know about the other side.

From what we've seen, the side A of your connection doesn't have access to your DNS server. What you need to do is check if port 53 udp/tcp is open in that direction.

fboaventura
  • 1,135
  • 11
  • 16
  • So interestingly enough, I switched the VPN to IKEv1, sha1 and AES-128 and it functions absolutely fine. As soon as I increase the standards of security on that end DNS is tottally blocked. Any idea why this would be? Initially I was using IKEv2, SHA256, AES-256. I don't seem to have any issues with the port being open, it seems to just be how the UDM is handling traffic over the VPN settings. – David May 28 '21 at 03:25