topic Re: New DMZ ISE node not able to reach DNS on inside zone in Network Access Control

New DMZ ISE node not able to reach DNS on inside zone

blocksupport — Thu, 07 Nov 2024 10:51:42 GMT

I am deploying a new ISE node which resides within a DMZ zone on FTD. During the initial bootstrapping it is failing to reach the name server .

ISE node 192.168.235.12 - DMZ zone

DNS 192.168.245.246

I have created a policy on the FTD and ran a packet capture the traffic is allowed.. What else could be stopping this?

Re: New DMZ ISE node not able to reach DNS on inside zone

Flavio Miranda — Thu, 07 Nov 2024 11:34:38 GMT

@blocksupport

Where the DNS server is connected? Does it have gateway or use route table?

Re: New DMZ ISE node not able to reach DNS on inside zone

Aref Alsouqi — Thu, 07 Nov 2024 11:35:58 GMT

What action did you apply to that rule? I would try to change it to "trust" if that is not already applied. Another thing come to mind, in terms of routing, does the DNS server know how to reach ISE?

Re: New DMZ ISE node not able to reach DNS on inside zone

MHM Cisco World — Thu, 07 Nov 2024 11:40:44 GMT

Share packet tracer ypu run'

Send it to me as PM

MHM