asa dns lookup fails using bvi interface

[webastien]

Hello all,

To precise title, quite clear itself i hope, here are some informations.
[asa5506x box][version 9.8.2.24]
In order, all went fine using a 'classical' interface configuration and DefaultDNS server-group. I changed the physical inside interface to a bvi interface, pushed some bridge-group commands etc. All worked (nat, accesses, etc (vpn not tested)) except fqdn objects as logs are showing :

3    Mar 24 2018    21:06:20    746016                    user-identity: DNS lookup for fr.pool.ntp.org failed, reason:Timeout or unresolvable
3    Mar 24 2018    21:06:20    746016                    user-identity: DNS lookup for fr.pool.ntp.org failed, reason:UNKNOWN

And ping www.cisco.com fails too.

No firepower service-policy,
No inspect dns; tested,
dns domain-lookup inside_1 added (dns server is inside, behind this interface)
dns domain-lookup inside (bvi)

A capture shows dns requests are leaving firewall correctly ; a tcpdump on dns server confirms. Dns answers are arriving on inside too (capture).

So, if someone gets an idea or information to fix that point, it will be appreciate.

/seb
ps: Sorry for my bad english.

[Mohammed al Baqari]

Share your config? Usually BVI is used to bridge two VLANs in transparent mode but lets see your config 

[webastien]

Thanks for your help Mohammed.

/seb

[Mohammed al Baqari]

Are you able to ping your DNS server

[webastien · Accepted solution]

Yep.

I found how to fix this problem :
DNS server-group DefaultDNS
!adding inside_1 at the end of ...
    name-server 192.168.1.112 inside_1
    domain-name dune

(inside_1 does not match my bvi.)
Bad point is playing with the configuration, capture always gave requests and answers ! (cli in attached file)

Thank you mohammed, I did not understand why to ping but it forced me to insist  ;)

/seb