0

When I try to ping a certain FQDN, I fail:

$ ping test-customer-1.clients.jsonar.com
ping: test-customer-1.clients.jsonar.com: Name or service not known

However, dig et al. succeeds:

$ dig test-customer-1.clients.jsonar.com

; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> test-customer-1.clients.jsonar.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57830
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;test-customer-1.clients.jsonar.com. IN A

;; ANSWER SECTION:
test-customer-1.clients.jsonar.com. 3119 IN CNAME _r1.clients.jsonar.com.
_r1.clients.jsonar.com. 3119    IN  CNAME   _w1.clients.jsonar.com.
_w1.clients.jsonar.com. 3119    IN  A   3.209.217.53

;; Query time: 15 msec
;; SERVER: 192.168.1.99#53(192.168.1.99)
;; WHEN: Fri Apr 12 15:44:21 PDT 2019
;; MSG SIZE  rcvd: 115

$ nslookup test-customer-1.clients.jsonar.com.
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
test-customer-1.clients.jsonar.com  canonical name = _r1.clients.jsonar.com.
_r1.clients.jsonar.com  canonical name = _w1.clients.jsonar.com.
Name:   _w1.clients.jsonar.com
Address: 3.209.217.53

$ host test-customer-1.clients.jsonar.com
test-customer-1.clients.jsonar.com is an alias for _r1.clients.jsonar.com.
_r1.clients.jsonar.com is an alias for _w1.clients.jsonar.com.
_w1.clients.jsonar.com has address 3.209.217.53

Files:

$ cat /etc/resolv.conf 
# Generated by NetworkManager
nameserver 192.168.1.99
nameserver 8.8.8.8

$ cat /etc/sysconfig/network-scripts/ifcfg-enp0s31f6 
TYPE="Ethernet"
BOOTPROTO="dhcp"
DEFROUTE="yes"
PEERDNS="yes"
PEERROUTES="yes"
IPV4_FAILURE_FATAL="no"
IPV6INIT="yes"
IPV6_AUTOCONF="yes"
IPV6_DEFROUTE="yes"
IPV6_PEERDNS="yes"
IPV6_PEERROUTES="yes"
IPV6_FAILURE_FATAL="no"
IPV6_ADDR_GEN_MODE="stable-privacy"
NAME="enp0s31f6"
UUID="cf566dc0-de91-497d-a045-560fddfbaf3e"
DEVICE="enp0s31f6"
ONBOOT="yes"
DNS1=8.8.8.8

$ cat /etc/nsswitch.conf | grep hosts
#hosts:     db files nisplus nis dns
#hosts:      files mdns4_minimal [NOTFOUND=return] dns myhostname
hosts:      files dns myhostname

Edits:

$ getent hosts test-customer-1.clients.jsonar.com
$ echo $?
2
# According to the man page, exit code 2 means: 
# One or more supplied key could not be found in the database

Pinging from Linux machines fail, but succeed from Windows machines.

boardrider
  • 949
  • 2
  • 18
  • 29
  • What does 'host test-customer-1.clients.jsonar.com' result – Jacob Evans Apr 13 '19 at 00:55
  • Or more interestingly, what does `getent hosts test-customer-1.clients.jsonar.com`. – Zoredache Apr 13 '19 at 05:02
  • I guess the DNS server at `192.168.1.99` cannot resolve the address. You can verify that with 'dig test-customer-1.clients.jsonar.com @192.168.1.99`. If that is the case fix the DNS server at `192.168.1.99` or just use `8.8.8.8'. – Thomas Apr 13 '19 at 17:13
  • 1
    1) ping is not a tool to use to debug troubleshooting problems, only dig fits for that purpose and 2) never use dig without the `@` option otherwise you do not really control which nameserver you query. – Patrick Mevzek Apr 14 '19 at 03:29
  • The DNS module on 192.168.1.99 (it's a FortiGate firewall box) can resolve only addresses on the .local LAN. Any external name resolutions are forwarded to FortiNet DNS servers. As you can see in the question, @Thomas, /etc/resolv.conf includes 8.8.8.8. – boardrider Apr 15 '19 at 17:45
  • Thanks for the suggestion, @ Zoredache 2 days ago: `getent hosts test-customer-1.clients.jsonar.com` returns nothing and sets exit code to 2 (One or more supplied key could not be found in the database). – boardrider Apr 15 '19 at 17:50

1 Answers1

0

Turns out the problem was caused by quite a bizarre misconfiguration:
test-customer-1.clients.jsonar.com record in DNS was NS instead of an A record. (Seems that Windows doesn't care, which is why pings from a Windows machine were successful, but *nix treats this misconfiguration (correctly) as a possible security breach, and fails the pings).

Once test-customer-1.clients.jsonar.com was registered in DNS with an A record, the issue was resolved.

boardrider
  • 949
  • 2
  • 18
  • 29