<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<font face="Helvetica, Arial, sans-serif">Question Djerk: why are
you running your firewalls in active/active? This is an unusual
configuration that has many challenges, including the one you've
just mentioned.<br>
<br>
Regards<br>
<br>
Robby<br>
<br>
</font><br>
<div class="moz-cite-prefix">On 2025/05/12 15:04, Djerk Geurts via
Pdns-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:6CCD76D8-CC96-4E2A-BE86-B8F486C2E703@maizymoo.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div>An odd statement possibly, but I’m looking for a way to solve
a problem (even if it’s a temporary solution).</div>
<div><br>
</div>
<div>The DC firewalls have changed and the recursors are located
in a DMZ behind two HA firewalls in active/active mode. So far
so good. The firewalls sync their state tables, so asymmetric
return traffic works fine. Except when the recursor replies so
quickly that the sync hasn’t updated the state table yet for the
return packets. As a result we’re seeing a few drops among a lot
of perfectly fine traffic.</div>
<div><br>
</div>
<div>I have a few things I can do:</div>
<div><br>
</div>
<div>1) permit all outbound traffic with source udp/53 from the
recursors. Not ideal, but low risk.</div>
<div>2) raise a support ticket with the firewall vendor. Will do
this, but not holding my breath for a solution (if any)</div>
<div>3) delay DNS replies a millisecond or so. Not ideal as this
introduces delay.</div>
<div><br>
</div>
<div>Thoughts?</div>
<br>
<div>
<meta charset="UTF-8">
<div dir="auto"
style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div>-- <br>
Best regards,<br>
<b>Djerk Geurts</b></div>
</div>
</div>
<br>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre wrap="" class="moz-quote-pre">_______________________________________________
Pdns-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a>
<a class="moz-txt-link-freetext" href="https://mailman.powerdns.com/mailman/listinfo/pdns-users">https://mailman.powerdns.com/mailman/listinfo/pdns-users</a>
</pre>
</blockquote>
<br>
</body>
</html>