Cisco ESA DNS priority

[ccna_security]

HI. Could you please tell me why cisco recommends to change DNS priority to 0? I have 4 DNS server that ordered 0,1,2,3 but cisco docummentation recommends to change all to 0. why?

[dmccabej]

Hello,

When you set all or multiple priorities to 0 it then attempts to balance the load of DNS requests in a round-robin type fashion. If you have maybe 1 or 2 ESA/s and a small volume of traffic, setting them as 0,1,2,3 or even 0,0,1,1 may not be that bad, but, when dealing with larger deployments you're going to want to make sure the DNS requests are balanced out as evenly as possible. The ESA relies heavily on DNS.

Keep in mind, this is also subjective to the number of resources available to your DNS server(s) and how well they respond to a large number of requests. Along with your network, Etc, Etc. So, your mileage may vary.

Thanks!

-Dennis M.

[ccna_security]

Hello Dennis

We only have one virtual esa and 4 dns server including google dns. Is it ok to configure all dns priority (4 dns 0,1,2,3) to 0?

[PankajSharma1807]

Hi,

Basically, it's up to you what kind of load balancing you want. If all DNS are having same priority i.e. 0 then request can go to any of the DNS servers on round robin fashion whereas if you want the google DNS to be first DNS server to serve all the requests and your own DNS servers to be second then you can use priority 0 for google and 1,2 ..etc for your own servers.

[ccna_security]

Hi, 

What does round bobin fashion mean? 

[dmccabej]

Hello,

Quite a few things you can find out on the Internet for DNS round-robin, but, if you're looking for ESA AsyncOS specific details then we also have some information within the user guide(s) for how the priorities work and how the servers are queried.

https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-5/user_guide/b_ESA_Admin_Guide_12_5/b_ESA_Admin_Guide_12_1_chapter_0100010.html#con_1145602

Thanks!

-Dennis M.

[ccna_security]

Thanks Dennis

[PankajSharma1807]

Sorry typo it's DNS round-robin