topic Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156 in Network Access Control

DNS A/AAAA record low level API query error in ISE version 2.6.0.156

John Vierra — Tue, 23 Jul 2019 13:14:18 GMT

I appear to be running into bug CSCuz96643 but the bug says it's fixed in 2.6(0.156) which is what I'm running. How can I figure out what is causing this?

Thanks

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

Surendra — Tue, 23 Jul 2019 13:24:51 GMT

Based on the result and remedy section, you are not running into the bug. This shows a genuine problem with your DNS server configuration where there is no low level record for DNS A/AAAA record. Would suggest you to check with your AD team.

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

Surendra — Wed, 24 Jul 2019 10:48:24 GMT

Looks like a new bug CSCvp54424

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

John Vierra — Wed, 24 Jul 2019 14:51:57 GMT

Thanks

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

hunnymonster — Thu, 29 Aug 2019 11:38:53 GMT

Exact same issue persists after applying patch 2.

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

Jason Kunst — Wed, 04 Sep 2019 13:16:31 GMT

please reach out to the TAC for break fix

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

hunnymonster — Wed, 04 Sep 2019 13:20:44 GMT

Why not simply publish a fix for all?

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

Jason Kunst — Wed, 04 Sep 2019 13:30:55 GMT

Not sure of the question here. Please reach out to the TAC to troubleshoot and explain your problem. You will need a tac case and defect to move forward. The community is not for break/fix troubleshooting bugs..

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

hunnymonster — Wed, 04 Sep 2019 13:42:43 GMT

Your colleague (@Surendra, accepted solution) posted that it's a bug you corporately already know about - that was originally reported by another Cisco Employee (@John Vierra).

My point here (as a paying customer) is that if you have a fix that I can get via TAC, that it would be better service for everyone if Cisco was to publish the fix (as part of a regular patch) so TAC can get on with triaging new bugs and not remediating bugs that have been fixed for 2 months.

I can go through the charade of opening a TAC case but really, you already know, I'm going to tell you nothing new and cynically I presume that if you haven't published an update that fixes the bug that you don't actually have a fix, so then I just wasted my time and TAC time and got no further forward.

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

Jason Kunst — Wed, 04 Sep 2019 13:56:59 GMT

This forum doesn’t work with defects normally. We offer solutions to how to configure something or setup a specific flow. The TAC is manned to handled cases and bugs and escalating to engineering for hot fixes and what goes into packages the way they see fit.

Here is general guidance https://community.cisco.com/t5/security-documents/how-to-ask-the-community-for-help/ta-p/3704356

I am sorry we can’t be a one stop shop for you

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

hunnymonster — Wed, 04 Sep 2019 14:04:45 GMT

It's not about this being a one stop shop - it's about Cisco publishing the fixes that it supposedly has (as per bug page for CSCvp54424) "Status: Fixed"

Known Fixed Releases:

(0)

If it's fixed, publish it. The last published update for ISE 2.6 that I see is dated July 30 and obviously doesn't fix this error.

Free feedback for Cisco: This is a general observation about your corporate processes around bug fixes - seemingly every bug I get hit by is "status:fixed" with no fixed releases. You have no comprehension how frustrating that is from this end.

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

hunnymonster — Wed, 04 Sep 2019 14:25:39 GMT

Back from TAC...

"This E-mail is the initial point of contact, to let you know that I have accepted your Service Request (xxxxxxxx).

From the problem description, I understand that ISE is affected by CSCvp54424

I can see the bug is fixed at patch 3 , the patch should be scheduled to be available at end of October."

Would that hurt to publish? I hope not, because I just did.

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

erga — Thu, 26 Sep 2019 16:39:49 GMT

Is there an operational impact with this bug. I'm having the same problem with my tacacs servers.

I will upgrade my ISE servers this weekend and not sure what this bug would cause.

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

hunnymonster — Fri, 27 Sep 2019 07:08:37 GMT

@erga it simply pollutes the logs with fake errors. Not hundreds but enough to make anyone that sees it wonder "what's wrong with my DNS?" (answer: nothing - it's ISE at fault). As above the patch to fix this is due at the end of October and will undoubtedly bring a whole new suite of bugs.

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

david.haughn — Sat, 12 Oct 2019 17:51:48 GMT

heh, i like you.

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

hunnymonster — Thu, 31 Oct 2019 22:36:33 GMT

So - it's 22:35UTC on 31/October - no sign of ISE 2.6.0 Update 3... no mention of any schedule slip.

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

Jason Kunst — Thu, 31 Oct 2019 23:38:27 GMT

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

No Comment on Roadmaps or Fixes

Sorry, but Cisco employees will not comment or respond to questions about roadmapped features or future capabilities. We also will not tell you when a fix for a bug that is bothering you might be available in a Release or Patch (see How to Get Cisco Bug Status & Notifications instead). Besides being considered Cisco Confidential information, anything can change at anytime for so many reasons that we do not want to set an expectation then have you be disappointed when it doesn't happen. So we just won't comment on futures.

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

ShaquilleDaniel — Fri, 15 Nov 2019 13:49:40 GMT

Hi @hunnymonster

I had the same issue, the resolution is to install Patch 3, for ISE 2.6.0.156. I had the same issue the patch was just released yesterday.

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

hunnymonster — Fri, 15 Nov 2019 14:25:10 GMT

Yep - I'm just waiting for the change window here to install it (and testing what it breaks in my test environment)

Re: DNS A/AAAA record low level API query error in ISE version 2.6.0.156

erga — Fri, 15 Nov 2019 15:39:51 GMT

I installed Patch 3, new warning
DNS SRV record query - SRV record found.Not all SRV records have IP, will need to run additional query for get IP.