DNS Lookups on ASA

RyanB — Fri, 21 Feb 2020 15:26:58 GMT

I have 2 firewalls, one functions fine, the other hangs when typing some commands that could contain hostnames.

Here are the 2x configs for DNS.

FAST ASA:

ASA-A# show run dns
dns domain-lookup outside
DNS server-group DefaultDNS
    name-server 172.16.51.30 inside
    name-server 8.8.8.8 outside
    name-server 172.16.54.30
    name-server 172.16.55.30
    name-server 172.16.56.30
    domain-name domain.com

ASA-A# ping t?
<instantly shows>
  tcp

ASA-A# traceroute a?
<instantly shows>
ERROR: % Unrecognized command

SLOW ASA:

ASA-B# show run dns
dns domain-lookup inside
dns domain-lookup mpls
dns domain-lookup outside
DNS server-group DefaultDNS
    name-server 172.16.64.30 inside
    name-server 172.16.51.30 mpls
    name-server 172.16.54.30 mpls
    name-server 172.16.55.30 mpls
    name-server 172.16.56.30 mpls
    name-server 8.8.8.8 
    domain-name domain.com

ASA-B# ping t?
<minutes later...>
  tcp

ASA-B# traceroute a?
<minutes later...>
ERROR: % Unrecognized command

We need DNS enabled for FQDN based objects used in ACLs, so I cannot issue the no ip domain-lookup command.

Is there anything I can do to prevent this?

Re: DNS Lookups on ASA

RyanB — Thu, 08 Mar 2018 22:12:14 GMT

Shameless bump!

Re: DNS Lookups on ASA

Florin Barhala — Fri, 09 Mar 2018 09:34:58 GMT

Can you try on the SLOW ASA this config:

ASA-B# show run dns
dns domain-lookup outside
DNS server-group DefaultDNS
name-server 8.8.8.8
domain-name domain.com

Re: DNS Lookups on ASA

jroy777 — Wed, 26 May 2021 17:02:02 GMT

Was this ever resolved?

topic Re: DNS Lookups on ASA in Network Security

DNS Lookups on ASA

Re: DNS Lookups on ASA

Re: DNS Lookups on ASA

Re: DNS Lookups on ASA