ASA dropping UDP/53 traffic on inside interface

kenneth.eisner — Mon, 11 Mar 2019 23:33:26 GMT

Greetings,

I've spent the better part of a week trying to pound this out.

We have a Cisco ASA 5505 (v7.2(3)) with a "fairly" normal configuration yet we have a problem where it appears UDP/53 traffic is denied on our inside network.

here is output from our sys log:

SyslogID Source IP Dest IP Description

305006 172.18.22.3 portmap translation creation failed for udp src inside:172.18.22.156/42013 dst inside:172.18.22.3/53

To give some clarification:

172.18.22.3 is one of our DNS servers

172.18.22.156 is a device we're experimenting with.

We've bypassed the Cisco by using a 4G wireless router with this same device - and it works flawlessly.

Here is a [scrubbed] copy of our config. It is what I inherited from the previous admin - I'm not sure of all its finer points (I'm not Cisco certified -- perhaps I'm just certifiable.)

Any help would be greatly appreciated.

-knme

: Saved

ASA Version 7.2(3)

hostname [redacted]

domain-name [redacted]

enable password [redacted] encrypted

names

interface Vlan1

nameif inside

security-level 100

ip address 172.18.22.6 255.255.255.0

interface Vlan2

nameif outside

security-level 0

ip address 999.999.999.999 255.255.255.248

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2

interface Ethernet0/3

interface Ethernet0/4

interface Ethernet0/5

interface Ethernet0/6

interface Ethernet0/7

passwd [redacted] encrypted

ftp mode passive

clock timezone EST -5

clock summer-time EDT recurring

dns domain-lookup outside

dns server-group DefaultDNS

name-server 198.6.1.142

name-server 198.6.1.1

domain-name ocm.local

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list inside_nat0_outbound extended permit ip any 172.18.22.64 255.255.255.240

access-list outside_access_in remark inbound icmp

access-list outside_access_in extended permit icmp any any echo

access-list outside_access_in remark inbound icmp-echo-reply

access-list outside_access_in extended permit icmp any any echo-reply

access-list inside_access_in extended permit tcp any eq domain any eq domain

access-list inside_access_in extended permit udp any eq domain any eq domain

access-list inside_access_in extended permit tcp any any

access-list inside_access_in extended permit udp any any

access-list inside_access_in extended permit icmp any any echo

access-list inside_access_in extended permit icmp any any traceroute

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool ABC 172.18.22.70-172.18.22.74 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-523.bin

no asdm history enable

arp timeout 14400

nat-control

global (outside) 101 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 101 172.18.22.0 255.255.255.0

access-group inside_access_in in interface inside

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 65.215.53.161 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

aaa-server OCM protocol nt

aaa-server OCM host 172.18.22.2

timeout 5

nt-auth-domain-controller Fileserv

aaa authentication ssh console LOCAL

http server enable

http 172.18.22.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto dynamic-map outside_dyn_map 20 set pfs

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh 172.18.22.0 255.255.255.0 inside

ssh timeout 5

console timeout 0

dhcpd auto_config outside

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect pptp

inspect icmp

inspect http

inspect icmp error

inspect ipsec-pass-thru

service-policy global_policy global

ntp server 64.90.182.55 source outside prefer

group-policy ABC internal

group-policy ABC attributes

dns-server value 172.18.22.2 172.18.22.3

vpn-tunnel-protocol IPSec

default-domain value ABC

username admin password [redacted] encrypted privilege 15

tunnel-group ABC type ipsec-ra

tunnel-group ABC general-attributes

address-pool ABC

authentication-server-group ABC

default-group-policy ABC

tunnel-group ABC ipsec-attributes

pre-shared-key *

prompt hostname context

Cryptochecksum:5d3c117cfd8e54a4ba032de9330c51f9

: end

asdm image disk0:/asdm-523.bin

no asdm history enable

ASA dropping UDP/53 traffic on inside interface

Karsten Iwen — Sun, 22 Jul 2012 21:49:03 GMT

Without looking at your config: You need to find out why your client .156 sends the packets to the ASA when he wants to reach your internal DNS. As they are both in the same subnet, the ASA shouldn't see that traffic. Start your troubleshooting at the IP-config and routing-config of the client.

ASA dropping UDP/53 traffic on inside interface

kenneth.eisner — Sun, 22 Jul 2012 22:51:59 GMT

Hello Karsten,

Thanks for a very prompt response. I do apreciate it.

Sadly I do not have access to the IP-config nor routing-config of the client. They're "black box units". They obtain IP address from our DHCP server - that is pretty much all I know about them.

Any other suggestions?

-knme

Re: ASA dropping UDP/53 traffic on inside interface

Karsten Iwen — Mon, 23 Jul 2012 07:58:45 GMT

Are there other clients with that problem? Have you doublechecked the DHCP-Scope?

Sent from Cisco Technical Support iPad App

Re: ASA dropping UDP/53 traffic on inside interface

kenneth.eisner — Tue, 24 Jul 2012 01:11:00 GMT

Thanks again Karsten,

No - no other users.

Did discover that when pinging the device the reply is being rejected by the firewall. All are in agreement that this sort of traffic should not be seen at the firewall level so we're really not sure what is going on.

Almost seems like the subnet of the device does not match the subnet of the rest of the network but it is nearly impossible to check b/c the device is not capable.

-knme

topic Re: ASA dropping UDP/53 traffic on inside interface in Network Security

ASA dropping UDP/53 traffic on inside interface

ASA dropping UDP/53 traffic on inside interface

ASA dropping UDP/53 traffic on inside interface

Re: ASA dropping UDP/53 traffic on inside interface

Re: ASA dropping UDP/53 traffic on inside interface

Re: ASA dropping UDP/53 traffic on inside interface