Description

This article describes the issue of Windows users being unable to logon to a computer, which uses AD authentication. Further investigation also found that DNS lookups for the AD server host name also fails.

Symptoms

  • First, you have to verify if or not the DNS responses for the AD server host name are being returned.
  • Then you will have to trace as to where the DNS responses are dropping.

Solution

  • External reason - Asymmetric Routing in the topology.
  • Design considerations - SRX is more than just a router; it is a firewall.
  • Active Directory uses Lightweight Directory Access Protocol (LDAP), Kerberos, and DNS.

Assume that the following topology leads to asymmetric routing (compare it with your topology): 

            DNS-Server Y (1.1.1.1 UDP:53)
                | |
                ^ v
                ^ v
                | |
   +--->>>----ROUTER-2--->>>----+
   |                            |  
   ^                            v  
   ^                            v
   |                            |
+--+--+                      +--+--+
|SRX-1|                      |SRX-2| <<< Packet is dropped by SRX-2
+--+--+                      +--+--+
   |                            |  
   ^                            |
   ^                            |
   |                            |
   +---<<<----ROUTER-1----------+
                | |
                | |
                ^ |
                ^ |
                | |
              Host X (2.2.2.2 UDP:12345)

DNS request packet movement (host to server - 2.2.2.2/12345 to 1.1.1.1/53) :

  1. The Packet goes from Host X to Router-1

  • Router-1 to SRX-1

  • SRX-1 to Router-2

  • Router-2 to DNS-Server Y


The tricky part is when you check the SRX-1 sessions. You will see that the DNS packets are moving towards the DNS server; but responses are not returned:

Session ID: 10000, Policy name: T2U/1, Timeout: 60, Valid
In: 2.2.2.2/12345 --> 1.1.1.1/53;udp, If: ge-0/0/0.0, Pkts: 1, Bytes: 60
Out: 1.1.1.1/53 --> 2.2.2.2/12345;udp, If: ge-0/0/1.0, Pkts: 0, Bytes: 0 << No packets coming back


DNS response packet movement (Server to host 1.1.1.1/53 to 2.2.2.2/12345)

  1. DNS server Y sends the response back for the Host X IP address.

  • This response packet comes on Router 2 and a route lookup for 2.2.2.2 tells Router 2 to send this response to SRX-2 (instead of SRX-1) This is a characteristic of asymmetric routing

  • The Packet lands on SRX-2.

  • SRX being a firewall detects that the response, which is coming back, does not match a Past DNS Request; so SRX drops the Response Packet.

  • On setting up Flow Traceoptions inside SRX-2, the trace logs provides the following information:  Packet dropped - DNS reply doesn't match existent session .


Note:  This drop is intentional and is facilitated by the Secure Design of SRX.


Workaround :

  1. Modify the Network design to eliminate scope of Asymmetric Routing (as you have purchased SRX to perform firewalling and not plain routing).

  • Set up the following configuration command:
    set security flow allow-dns-reply
    commit