DNS A/AAAA record low level API query error in ISE version 2.6.0.156

[John Vierra]

I appear to be running into bug CSCuz96643 but the bug says it's fixed in 2.6(0.156) which is what I'm running. How can I figure out what is causing this?

Thanks

[Surendra]

Based on the result and remedy section, you are not running into the bug. This shows a genuine problem with your DNS server configuration where there is no low level record for DNS A/AAAA record. Would suggest you to check with your AD team.

[Surendra · Accepted solution]

Looks like a new bug CSCvp54424

[John Vierra]

Thanks

[hunnymonster]

Exact same issue persists after applying patch 2.

[Jason Kunst]

please reach out to the TAC for break fix

[hunnymonster]

Why not simply publish a fix for all? 

[Jason Kunst]

Not sure of the question here. Please reach out to the TAC to troubleshoot and explain your problem. You will need a tac case and defect to move forward. The community is not for break/fix troubleshooting bugs..

[hunnymonster]

Your colleague (@Surendra, accepted solution) posted that it's a bug you corporately already know about - that was originally reported by another Cisco Employee (@John Vierra).

My point here (as a paying customer) is that if you have a fix that I can get via TAC, that it would be better service for everyone if Cisco was to publish the fix (as part of a regular patch) so TAC can get on with triaging new bugs and not remediating bugs that have been fixed for 2 months.

I can go through the charade of opening a TAC case but really, you already know, I'm going to tell you nothing new and cynically I presume that if you haven't published an update that fixes the bug that you don't actually have a fix, so then I just wasted my time and TAC time and got no further forward.

[Jason Kunst]

This forum doesn’t work with defects normally. We offer solutions to how to configure something or setup a specific flow. The TAC is manned to handled cases and bugs and escalating to engineering for hot fixes and what goes into packages the way they see fit.

Here is general guidance https://community.cisco.com/t5/security-documents/how-to-ask-the-community-for-help/ta-p/3704356

I am sorry we can’t be a one stop shop for you

[hunnymonster]

It's not about this being a one stop shop - it's about Cisco publishing the fixes that it supposedly has (as per bug page for CSCvp54424) "Status: Fixed"

Known Fixed Releases:

(0)

If it's fixed, publish it. The last published update for ISE 2.6 that I see is dated July 30 and obviously doesn't fix this error.

Free feedback for Cisco: This is a general observation about your corporate processes around bug fixes - seemingly every bug I get hit by is "status:fixed" with no fixed releases. You have no comprehension how frustrating that is from this end.

[hunnymonster]

Back from TAC... 

"This E-mail is the initial point of contact, to let you know that I have accepted your Service Request (xxxxxxxx).

From the problem description, I understand that ISE is affected by CSCvp54424

I can see the bug is fixed at patch 3 , the patch should be scheduled to be available at end of October."

Would that hurt to publish? I hope not, because I just did.

[erga]

Is there an operational impact with this bug. I'm having the same problem with my tacacs servers.

I will upgrade my ISE servers this weekend and not sure what this bug would cause.

[hunnymonster]

@erga it simply pollutes the logs with fake errors. Not hundreds but enough to make anyone that sees it wonder "what's wrong with my DNS?" (answer: nothing - it's ISE at fault). As above the patch to fix this is due at the end of October and will undoubtedly bring a whole new suite of bugs.

[david.haughn]

heh, i like you.