topic Re: Strange DNS-Request via VLAN, not Management-VLAN in ExtremeWireless (IQE)

Strange DNS-Request via VLAN, not Management-VLAN

NetAdmLWL — Mon, 19 Jul 2021 19:48:04 GMT

Hi there!

Since we updated HiveOS to V10.3 there are some strange DNS-Queries log entries in the Firewall.

We do not use Cloud-Services, we are working with APs on hivemanager Classic.

The APs do not have connections to the Internet.

The Problem: from V10.3 on there are strange DNS-Requests to www.google.com from the AP directly, not to the local DNS, but to a DNS-Server which we use in our Guest-WLAN => open to the internet, but it’s not accessible from the AP management-VLAN (tagged Port). The AP uses a DNS-Server which is not configured on them; they get the local DNS-Server, which is seen by “show dns”. But the request is send to the DNS-Server in the Guest-WLAN, which will be given via DHCP ONLY to Clients in a tagged VLAN (same Eth-Port like the AP).

I have found some things like “ping 8.8.8.8” and Client-Tracking via DNS/Google. But this way is not working and I have a firewall, which is actually blocking this traffic. But the Logs are full! See: there are up to 3 Requests from one AP, together we have about 250 APs Aerohive AP 130 running.

Can anybody help to stop these requests???

Hope, my words are not confusing…

Thanks

Frank from Münster, Germany.

Re: Strange DNS-Request via VLAN, not Management-VLAN

SamPirok — Mon, 19 Jul 2021 22:43:01 GMT

Have you tried disabling IP Tracking? Option 1 of this guide reviews how to do this: https://extremeportal.force.com/ExtrArticleDetail?an=000065955&q=Why%20do%20APs%20ping%208.8.8.8

Re: Strange DNS-Request via VLAN, not Management-VLAN

NetAdmLWL — Tue, 20 Jul 2021 12:32:11 GMT

Yes, I tried to.

But this was not ping, it is DNS-Request to a Server, which never will be reachable from this VLAN! Also: why will the management of the AP use a DNS-Server from a totally independent/autonomous VLAN?

Tried, but doesn’t help. Because there are no pings!

Regards.

Re: Strange DNS-Request via VLAN, not Management-VLAN

NetAdmLWL — Thu, 22 Jul 2021 18:24:05 GMT

Question this issue on another way…

Why is the Management IP (untagged VLAN) ot the AP using a DNS-Server-IP (!) from the Client-VLAN, which the AP is seeing (perhaps) via a DHCP-Reply on a separated (tagged) VLAN? The IP is not accessible via Management-VLAN…

Strange...