topic Re: DNS Resolution in Cisco ASA 5525 in Network Security

DNS Resolution in Cisco ASA 5525

Cityofrefuge7 — Tue, 12 Mar 2019 03:33:55 GMT

Hey all,

I will begin by telling you what my end goal is, I am trying to block specific websites on our cisco ASA 5525 using FDQN. I know that this functionality for DNS resolution was not implemented until a specific version.

Current Version: Cisco ASA 5525

ASA Version: 8.6(1)

I can ping external addresses from the ASA however I cannot ping hostnames like "ping google.ca" does not work.

What I've done.

dns domain-lookup inside

dns domain-lookup outside

name-server x.x.x.x (Primary internal dns server)

name-server x.x.x.x (Secondary internal dns server)

name-server 8.8.8.8 (Google external dns server)

name-server 8.8.4.4 (Google external dns server)

domain-name example.com

With this config I can, however, ping hostnames of internal servers.

This is an example of me pinging an external hostname.

ciscoasa# ping google.ca

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2607:f8b0:4009:803::101f, timeout is 2 seconds:

No route to host 2607:f8b0:4009:803::101f

Success rate is 0 percent (0/1)

Any ideas?

Thanks!

DNS Resolution in Cisco ASA 5525

johnlloyd_13 — Wed, 22 Jan 2014 08:20:26 GMT

hi jonathan,

could you try adding using the default DNS group?

dns server-group DefaultDNS

name-server x.x.x.x

name-server 8.8.8.8

name-server 8.8.4.4

domain-name example.com

DNS Resolution in Cisco ASA 5525

Cityofrefuge7 — Wed, 22 Jan 2014 13:53:13 GMT

Hi John,

Thanks for your quick reply.

I forgot to mention that I was adding the name servers and domain name to the DefaultDNS group already, though I did remove my secondary internal dns server to reflect exactly what you sent to me, unfortunately still no luck.

Re: DNS Resolution in Cisco ASA 5525

johnlloyd_13 — Wed, 22 Jan 2014 14:43:36 GMT

Hi,

Could you post 'ping www.google.com' and 'show route' output?

Sent from Cisco Technical Support iPhone App

Re: DNS Resolution in Cisco ASA 5525

Cityofrefuge7 — Wed, 22 Jan 2014 20:29:17 GMT

officeasa# ping www.google.com

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2607:f8b0:4009:802::1012, timeout is 2 seconds:

No route to host 2607:f8b0:4009:802::1012

Success rate is 0 percent (0/1)

John, due to the sensitive nature displayed within show route output, is there any other information I can tell you, what exactly did you need to see from this information?

(I know without certain information you cannot help but I need to ensure security on my end)

Thanks for understanding.

Re: DNS Resolution in Cisco ASA 5525

Cityofrefuge7 — Fri, 24 Jan 2014 15:14:51 GMT

Any other idea's guys?