ASA Firepower 5506-X Blocking DNS Service

[hoang pham]

Hi all,

I've just set up FW 5506-X, after putting DNS server behind the firewall with default "balance and security" intrusion policy, and malware blocking(I added all Category, and chose Block Malware), all pcs and even FW itself cannot use DNS service anymore, every others service like ping, RD are still OK, DNS Server is using win 2008 R2. Checked log and i saw UDP port 53 were allowed (attachment).

Please help! Thank you!

[Abheesh Kumar]

Hi,
As per the logs you provided shows DNS traffic is allowed. Could you check in intrusion events and malware events if anything is getting blocking.

HTH
Abheesh

[hoang pham]

Hi Kumar,

I checked it, there is no log in Intrusion events, Malware or Security Intelligent ( i ticked only logged at the end of connection )

[Abheesh Kumar]

can you do a packet tracer and share the output

[hoang pham]

I'll try to do it next time, we removed FW for now, Is there anything else i need to test? Pls put it all here then i will provide u later.