EX SSL-VPN: Netbios broadcasts send by the workplace service for the configured primary and Seconda

03/26/2020 1,055 People found this article helpful 208,898 Views

Download

Print

Share

• LinkedIn
• Twitter
• Facebook
• Email
• Copy URL The link has been copied to clipboard

Description

EX SSL-VPN: Netbios broadcasts send by the workplace service for the configured primary and Secondary WINS Servers

Resolution

Problem Definition:

If the appliance is setup with Primary and Secondary WINS Server (in this example 172.16.252.2, 172.16.252.9), Whenever there is a change on the appliance configurartion the following type of Netbios broadcast query is send by the appliance:-

13:12:07.202064 IP (tos 0x0, ttl 64, id 26015, offset 0, flags [DF], proto: UDP (17), length: 71) 172.16.251.61.32778 > 172.16.252.2.53: [udp sum ok] 64392+ A?172.16.252.2,172.16.252.9. (43)
13:12:07.202769 IP (tos 0x0, ttl 128, id 22264, offset 0, flags [none], proto: UDP (17), length: 146) 172.16.252.2.53 > 172.16.251.61.32778: [udp sum ok] 64392 NXDomain q: A? 172.16.252.2,172.16.252.9. 0/1/0 ns: . SOA
a.root-servers.net. 2010052601 1800 900 604800 898 (118)
13:12:07.202930 IP (tos 0x0, ttl 64, id 26016, offset 0, flags [DF], proto: UDP (17), length: 79) 172.16.251.61.32778 > 172.16.252.2.53: [udp sum ok] 2048+ A?172.16.252.2,172.16.252.9.ssl.lab. (51)
13:12:07.203518 IP (tos 0x0, ttl 128, id 22265, offset 0, flags [none], proto: UDP (17), length: 138) 172.16.252.2.53 > 172.16.251.61.32778: [udp sum ok] 2048 NXDomain* q: A? 172.16.252.2,172.16.252.9.ssl.lab. 0/1/0 ns: ssl.lab. SOA
appliance.ssl.lab. hostmaster.ssl.lab. 492 900 600 86400 3600 (110)

Resolution or Workaround:

The above query is invalid and SonicWall has investigated this symptom. SonicWall will address this issue on the upcoming firmware releases 10.0.5 & 10.5.2

How to Test:

a. Setup Primary & Secondary WINS Server on the Appliance
b. Make any change in the AMC (Ex AUTH Server - Cache lifetime value, applied
pending change)
c. Perform a capture to see the DNS query sent from the appliance.

Tracking ID: 91037

Related Articles

• How to deploy SMA100 series virtual appliance (SMA 500v) from one platform to another.
• SMA100:After upgrading to 10.2.1.7, began receiving nonstop alert emails stating "WAF threat prevented:
• SMA1000:When both IPv4 and IPv6 are enabled for the network interface, the first few connection attempts fail, but everything works fine after that.

Categories

• Secure Mobile Access > SMA 1000 Series