ASA 8.4.3, does it check DNS source IP address??

[aacole]

Does ASA 8.4.3 check the source IP address of  a DNS reply and drop it if the reply address is different to that in the query?

Customers DNS server does this due to a recent change, their server now has a virtual address, but replies are sent from its physcial address. This is temporary. Their PIX is happy with this.

Replace the PIX with the ASA, DNS fails, the only reason I can see is due to the way their internal DNS operates.

[Marcin Latosiewicz]

To be honest there's two levels to thing about this.

1) A reply from somewhere else SHOULD be treated as separete connection on L3/L4 level. So it will be allowed if security policy allows it.

2) On L7 we verify if reply packet is corresponding to a known request (based on ID AFAIR)