topic Re: DNS lookups fail behind FTD in Network Security

DNS lookups fail behind FTD

techno.it — Wed, 01 Apr 2020 23:41:42 GMT

I have FTD and FMC virtual.

The client behind FTD are unable to resolve DNS names, however I can ping DNS servers. The clients are using 8.8.8.8 and 208.67.222.222

I am able to open websites by adding static entry into windows hosts but using DNS servers none are accessible.

I have disabled dns inspection but no luck. The packet tracer does not show any drop, everything is allowed and successful.

Any suggestions ?

Re: DNS lookups fail behind FTD

Francesco Molino — Thu, 02 Apr 2020 02:33:58 GMT

Hi

Can you share the packet tracer please?
DNS ports are opened towards internet to these 2 hosts right?

Re: DNS lookups fail behind FTD

techno.it — Thu, 02 Apr 2020 06:38:23 GMT

Yes, I have open any ports from these hosts to the internet, even FMC and FTD cannot resolve the hostnames.

I've was unable to attach pcap hence I am posting screenshot. Please let know if that would work.

Re: DNS lookups fail behind FTD

Francesco Molino — Fri, 03 Apr 2020 01:54:52 GMT

Ok we don't see responses.
Let's assume the lan interface is named inside.
Connect to your ftd using ssh, then type system support diagnostic.
Then type enable and when it asks about a password just hit enter.

Afterwards run the following command:
packet-tracer input inside udp 10.10.11.201 54641 8.8.8.8 53

Share please the output.