ASA access to FQDN

[Sergey Prishchepa]

On the ASA 5525-X is configured to access FQDN. Everything works well, but there is one feature. Lifetime matching FQDN and ip default 21 min., Obtained 21 minutes after ASA updates the information, but she did it for a minute and all this time blocked traffic. TTL for dns can be increased, but how to reduce this minute interval, preferably up to 1 second?

[David White]

Hi Sergey,

You cannot lower the ASA's DNS aging timeout below 1 minute.  Note that each time the timeout occurs, the ASA must refresh the DNS entry, and then update and re-compile the ACLs (where the FQDN name is used).  If you had multiple entries expiring every second, the policy would constantly be changing and the ASA would be constantly re-compiling the ACLs (ie: the Security Policy).

Hope this helps,

David.