topic Re: Firepower 1140 DNS hostname resolution issue in Network Security

Firepower 1140 DNS hostname resolution issue

Singh007 — Wed, 05 Jul 2023 12:48:34 GMT

I have Firepower 1140 running ASA code 9.14.1 .

when i ping 8.8.8.8 its happening but when i ping wwwogoogle.com or tools.cisco.com its not pinging.

i have attached the log files along with debug dns as attachment for reference , let me know what i can do

i have configured default DNS for domain lookup outside for dns 8.8.8.8, 4.2.2.2, 208.67.222.222 208.67.220.220.

Need some help Since TAC has refused assistance as this is a new deployment.

Re: Firepower 1140 DNS hostname resolution issue

Singh007 — Wed, 05 Jul 2023 12:49:14 GMT

attached file for reference

Re: Firepower 1140 DNS hostname resolution issue

Singh007 — Wed, 05 Jul 2023 12:52:13 GMT

i have tried to ping tools.cisco.com ip 72.163.4.38 and its working and attached in the file for reference

Re: Firepower 1140 DNS hostname resolution issue

MHM Cisco World — Wed, 05 Jul 2023 12:55:41 GMT

you control this FPR with FMC ?

Re: Firepower 1140 DNS hostname resolution issue

Singh007 — Wed, 05 Jul 2023 12:56:29 GMT

i also tried doing packet-tracer for 8.8.8.8 but hitting implicit deny:

packet-tracer input outside udp 103.48.47.20 56789 8.8.8.8 53 detailed

Phase: 1
Type: INPUT-ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
Found next-hop 103.48.47.1 using egress ifc outside

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fd6b645cb90, priority=501, domain=permit, deny=true
hits=8, user_data=0x7, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=103.48.47.20, mask=255.255.255.255, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any,, dscp=0x0
input_ifc=outside, output_ifc=any

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule, Drop-location: frame 0x000055c94e727680 flow (NA)/NA

Re: Firepower 1140 DNS hostname resolution issue

MHM Cisco World — Wed, 05 Jul 2023 13:03:31 GMT

DNS UDP port 53 is closed according to above packet tracer,
there is any ACL apply to INside interface ?

Re: Firepower 1140 DNS hostname resolution issue

Singh007 — Thu, 06 Jul 2023 08:52:14 GMT

this is a new implementation, the two other firewalls fpr 1010 is working fine with same DNS config. But this is not working.

This will be managed by ASDM , but currently its working only via CLI

Re: Firepower 1140 DNS hostname resolution issue

MHM Cisco World — Thu, 06 Jul 2023 09:02:21 GMT

Share full config if you use cli

Thanks

MHM

Re: Firepower 1140 DNS hostname resolution issue

Aref Alsouqi — Fri, 07 Jul 2023 15:59:58 GMT

You should specify the inside interface in the packet tracer not the outside one. Also, could you please try to remove the domain name from the DNS group and try again?

Re: Firepower 1140 DNS hostname resolution issue

MHM Cisco World — Fri, 07 Jul 2023 16:48:35 GMT

totally correct He must use INside not OUTside