topic Re: ASA multiple dns server groups not work in Network Security

ASA multiple dns server groups not work

Sergey Prishchepa — Wed, 03 Jul 2019 08:56:17 GMT

Hello!

I make multiple dns server groups for ASA5525 asa991-smp-k8.bin like this:

dns domain-lookup outside
dns domain-lookup inside
!
dns server-group DefaultDNS
name-server 192.168.1.1
name-server 192.168.1.2
domain-name dns1.com
!
dns server-group DNS2
name-server 192.168.2.1
name-server 192.168.2.2
domain-name dns2.com

Dns server-group DefaultDNS work fine, but dns server-group DNS2 does not work.

sh dns host host2.dns2.com
Name: host2.dns2.com (unresolved)

host2.dns2.com exists and nslookup is working from the network inside.

What is the problem?

Re: ASA multiple dns server groups not work

Karsten Iwen — Thu, 04 Jul 2019 11:31:14 GMT

I assume you have the wrong expectation on what the server-groups do. For each given function, only one server-group is used. The ASA uses the DefaultDNS group. The aim of having a second or more of these groups is to have different functions use different servers.

Example:

The ASA itself used DefaultDNS. But you host a clientless VPN-portal for two different customers. For each customer, you can configure one DNS-group so that they can access their internal resources.

Re: ASA multiple dns server groups not work

Sergey Prishchepa — Thu, 04 Jul 2019 13:21:57 GMT

OK. If I add all servers for different domains in Default DNS, will it work?

Re: ASA multiple dns server groups not work

Karsten Iwen — Thu, 04 Jul 2019 14:57:51 GMT

No, you have to solve this problem on the DNS-server. That server needs to resolve dns2.com or forward the request to the right name server.

Re: ASA multiple dns server groups not work

Sergey Prishchepa — Thu, 04 Jul 2019 16:23:52 GMT

Thanks a lot!