Some server cant access internet 100

ilham Lv2Posted Nov-21-2025 10:40

HI i have an issue.

1. this issue is suddenly happen without any changes of configuration from NSF.
2. the flow is : Server VM -> TOR switch -> Core Switch - NSF Firewall
3. same segment/subnet with different IP is can connect to internet
4. the firewall host server is disable
5. the server can ping to 8.8.8.8 and cant with domain google.com
6. changed priority dns still with public dns
7. check the log from NSF outbound traffic is 0 (no traffic out), there is an application policy/rule for the server with /24
8. the source NAT has been apply also
9.  confirmed there is no blocking port 53
10. traced route from problematic server stoped at NSF gateway for peer-to-peer between NSF and Core Switch
11. confirmed availability route to internet

what other steps that i must check ?

thank you

net_specialist has solved this question and earned 10 coins.

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins, 100 coins of bounty and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

1. Verify DNS Resolution Path

Run nslookup google.com or dig google.com from the problematic server.
Does it time out or return an error?
If it fails, check which DNS server is being queried.

2. Check Firewall Policy for DNS

Even if port 53 isn’t blocked globally, confirm:
Is there an application policy that restricts DNS traffic for this server?
Does the NSF firewall allow UDP and TCP on port 53 outbound for this specific IP?

3. Inspect NAT and Routing

Confirm that DNS traffic is being NATed correctly.
Sometimes NAT rules apply only to certain subnets or protocols.
Use packet capture on NSF to see if DNS packets leave the firewall.
Is this answer helpful?
net_specialist Lv1Posted Nov-21-2025 13:24
  
1. Verify DNS Resolution Path

Run nslookup google.com or dig google.com from the problematic server.
Does it time out or return an error?
If it fails, check which DNS server is being queried.

2. Check Firewall Policy for DNS

Even if port 53 isn’t blocked globally, confirm:
Is there an application policy that restricts DNS traffic for this server?
Does the NSF firewall allow UDP and TCP on port 53 outbound for this specific IP?

3. Inspect NAT and Routing

Confirm that DNS traffic is being NATed correctly.
Sometimes NAT rules apply only to certain subnets or protocols.
Use packet capture on NSF to see if DNS packets leave the firewall.
ilham Lv2Posted Nov-21-2025 14:39
  
1. yes dns resolved , no error found
2. there is no restricts policy , allow udp and tcp 53
3. i will check on this first

I Can Help:

Change

Moderator on This Board

43
6
2

Started Topics

Followers

Follow

1
148
3

Started Topics

Followers

Follow

900
179
94

Started Topics

Followers

Follow

Board Leaders