topic Re: asa dns lookup fails using bvi interface in Network Security

asa dns lookup fails using bvi interface

webastien — Fri, 21 Feb 2020 15:33:30 GMT

Hello all,

To precise title, quite clear itself i hope, here are some informations.
[asa5506x box][version 9.8.2.24]
In order, all went fine using a 'classical' interface configuration and DefaultDNS server-group. I changed the physical inside interface to a bvi interface, pushed some bridge-group commands etc. All worked (nat, accesses, etc (vpn not tested)) except fqdn objects as logs are showing :

3 Mar 24 2018 21:06:20 746016 user-identity: DNS lookup for fr.pool.ntp.org failed, reason:Timeout or unresolvable
3 Mar 24 2018 21:06:20 746016 user-identity: DNS lookup for fr.pool.ntp.org failed, reason:UNKNOWN

And ping www.cisco.com fails too.

No firepower service-policy,
No inspect dns; tested,
dns domain-lookup inside_1 added (dns server is inside, behind this interface)
dns domain-lookup inside (bvi)

A capture shows dns requests are leaving firewall correctly ; a tcpdump on dns server confirms. Dns answers are arriving on inside too (capture).

So, if someone gets an idea or information to fix that point, it will be appreciate.

/seb
ps: Sorry for my bad english.

Re: asa dns lookup fails using bvi interface

Mohammed al Baqari — Sun, 25 Mar 2018 04:26:25 GMT

Share your config? Usually BVI is used to bridge two VLANs in transparent mode but lets see your config

Re: asa dns lookup fails using bvi interface

webastien — Sun, 25 Mar 2018 18:06:29 GMT

Thanks for your help Mohammed.

/seb

Re: asa dns lookup fails using bvi interface

Mohammed al Baqari — Mon, 26 Mar 2018 09:36:22 GMT

Are you able to ping your DNS server

Re: asa dns lookup fails using bvi interface

webastien — Mon, 26 Mar 2018 18:09:57 GMT

Yep.

I found how to fix this problem :
DNS server-group DefaultDNS
!adding inside_1 at the end of ...
name-server 192.168.1.112 inside_1
domain-name dune

(inside_1 does not match my bvi.)
Bad point is playing with the configuration, capture always gave requests and answers ! (cli in attached file)

Thank you mohammed, I did not understand why to ping but it forced me to insist 😉

/seb