Description

FQDNs in address books are not being resolved after an upgrade to 22.4R3-S2.

Symptoms

Security policies using FQDN objects will not be hit by the traffic going to the domains and will be likely dropped.

Solution

If the policies using FQDN book objects are not being hit after an upgrade to 22.4R3-S2 check the DNS cache entries with "show security dns-cache" command, if the output only shows the DNS name then NSD probably has this task stuck, consider restarting NSD using "restart network-security" from the Junos CLI (operational mode), after the restart the "show security dns-cache" command output should show something like the following:

 

> show security dns-cache dns-name xxxxxx

DNS Name: xxxxxx

Address Family: IPv4, TTL: 9

IP Address: x.x.x.x

Modification History

2024-07-22 : Article Created