Hello
One customer contacted us, because the Migros Banking App does not work from within our network and asked me to contact the Migros NOC to find out what we should change to make it work.
From the Migros NOC I got the feedback, that this is an issue they observed with customers whose ISP have IPv6 enabled DNS Server. They recommend that either the ISP disables IPv6 on the nameservers, or that the customers uses a different ISP, for example via Mobile Phone Hotspot to use their Banking app.
Apparently UPC Cablecom is another ISP with the same issue and cablecom is able to resolve the issue by disabling IPv6 for the affected customers.
I am a bit puzzled. I first suspected a DNSSEC issue as our servers do validate DNSSEC. But this does not seem to be the case.
I can resolve the hostnames without any problems via our DNS Servers.
Our DNS Servers are IPv6 enabled. When another DNS Server has an IPv6 address, they will prefer IPv6. But our customer does not get an IPv6 address. So his local resolver does only know the IPv4 address of our DNS Servers. The Migros DNS Servers do not publish an IPv6 address. So how is IPv6 involved in this issue?
The Domain in Question: mbmid.ch is:
mbmid.ch. 241 IN NS ns1.datacenter-migros.ch. mbmid.ch. 241 IN NS migze104.migros.ch. mbmid.ch. 241 IN NS migze100.migros.ch.
ns1.datacenter-migros.ch. 146 IN A 164.14.130.66 migze100.migros.ch. 3222 IN A 146.67.146.20 migze104.migros.ch. 3222 IN A 193.8.177.201
They are not DNSSEC Signed.
The only issue I found is that ns1.datacenter-migros.ch is not published in the registrar glue record, but this also would not lead to a failure to resolve the hostname.
Has anyone else come across that issue and could give me a hint where to further investigate?
-Benoît Panizzon-
I have to use this ½¬#6 piece of ł@#¼ too.
(compared to the old stick, I now have to run a windows VM for this, explains my slight anger?)
I think my VM is joined to my domaincontroller on a 2012 (without R2), which has a global v6 IP address. and that one is also the DNS
And the banking works, just loves to keep showing 404 errors all over when the session expires
Silvan
----- Ursprüngliche Mail ----- Von: "Benoit Panizzon" benoit.panizzon@imp.ch An: swinog@lists.swinog.ch Gesendet: Dienstag, 9. August 2016 13:47:58 Betreff: [swinog] 'known' DNS Problems with Migros Banking App?
Hello
One customer contacted us, because the Migros Banking App does not work from within our network and asked me to contact the Migros NOC to find out what we should change to make it work.
From the Migros NOC I got the feedback, that this is an issue they
observed with customers whose ISP have IPv6 enabled DNS Server. They recommend that either the ISP disables IPv6 on the nameservers, or that the customers uses a different ISP, for example via Mobile Phone Hotspot to use their Banking app.
Apparently UPC Cablecom is another ISP with the same issue and cablecom is able to resolve the issue by disabling IPv6 for the affected customers.
I am a bit puzzled. I first suspected a DNSSEC issue as our servers do validate DNSSEC. But this does not seem to be the case.
I can resolve the hostnames without any problems via our DNS Servers.
Our DNS Servers are IPv6 enabled. When another DNS Server has an IPv6 address, they will prefer IPv6. But our customer does not get an IPv6 address. So his local resolver does only know the IPv4 address of our DNS Servers. The Migros DNS Servers do not publish an IPv6 address. So how is IPv6 involved in this issue?
The Domain in Question: mbmid.ch is:
mbmid.ch. 241 IN NS ns1.datacenter-migros.ch. mbmid.ch. 241 IN NS migze104.migros.ch. mbmid.ch. 241 IN NS migze100.migros.ch.
ns1.datacenter-migros.ch. 146 IN A 164.14.130.66 migze100.migros.ch. 3222 IN A 146.67.146.20 migze104.migros.ch. 3222 IN A 193.8.177.201
They are not DNSSEC Signed.
The only issue I found is that ns1.datacenter-migros.ch is not published in the registrar glue record, but this also would not lead to a failure to resolve the hostname.
Has anyone else come across that issue and could give me a hint where to further investigate?
-Benoît Panizzon-
Hello Benoit,
I have just tested the Migros Banking App on Android on a WiFi network with an IPv4 only address. The dns resolver is validating and has an IPv4 and IPv6 address to resolve names.
If I start the App on my smartphone it resolves the following domain names: secure.migrosbank.ch. A mid.mbmid.ch. A
Both work without a problem and the App starts successfully. I also checked the domain names and nameservers. I don't see any problems except for the small issue with the additional authoritative nameserver (ns1.datacenter-migros.ch.) which should not cause any problems.
So, maybe it's a local device-, network problem of your customer and not of your infrastructure.
Daniel, SWITCH
On 09.08.16 13:47, Benoit Panizzon wrote:
Hello
One customer contacted us, because the Migros Banking App does not work from within our network and asked me to contact the Migros NOC to find out what we should change to make it work.
From the Migros NOC I got the feedback, that this is an issue they observed with customers whose ISP have IPv6 enabled DNS Server. They recommend that either the ISP disables IPv6 on the nameservers, or that the customers uses a different ISP, for example via Mobile Phone Hotspot to use their Banking app.
Apparently UPC Cablecom is another ISP with the same issue and cablecom is able to resolve the issue by disabling IPv6 for the affected customers.
I am a bit puzzled. I first suspected a DNSSEC issue as our servers do validate DNSSEC. But this does not seem to be the case.
I can resolve the hostnames without any problems via our DNS Servers.
Our DNS Servers are IPv6 enabled. When another DNS Server has an IPv6 address, they will prefer IPv6. But our customer does not get an IPv6 address. So his local resolver does only know the IPv4 address of our DNS Servers. The Migros DNS Servers do not publish an IPv6 address. So how is IPv6 involved in this issue?
The Domain in Question: mbmid.ch is:
mbmid.ch. 241 IN NS ns1.datacenter-migros.ch. mbmid.ch. 241 IN NS migze104.migros.ch. mbmid.ch. 241 IN NS migze100.migros.ch.
ns1.datacenter-migros.ch. 146 IN A 164.14.130.66 migze100.migros.ch. 3222 IN A 146.67.146.20 migze104.migros.ch. 3222 IN A 193.8.177.201
They are not DNSSEC Signed.
The only issue I found is that ns1.datacenter-migros.ch is not published in the registrar glue record, but this also would not lead to a failure to resolve the hostname.
Has anyone else come across that issue and could give me a hint where to further investigate?
-Benoît Panizzon-
Hi Daniel
In the meantime, the Migros APP Support center called me again.
They got in contact with the customer for further investigation in the problem and think they found the Problem.
The customer has an older ZyXEL WLAN Router with NAT.
The APP apparently uses some kind of ipsec connection. It's not 'standard' SSL they explained to me and the old ZyXEL are known not to support that variant with their NAT implementation.
So the issue is not IPv6 or DNS related.
I wonder what weird IP protocol migros uses :-)
-Benoît Panizzon-
-
Benoit Panizzon -
Daniel Stirnimann -
Silvan M. Gebhardt