Cisco ASA 5515-X DDNS Debug

[Blackbird2018]

Hi Guys

I am having some issues with getting my asa to update my dynamic ddns provider when my IP changes, can someone help me configure debugging for ddns on the asa.

I have tried "debug ddns" and than I get a message "debug ddns enabled at level 1" and don't get any alerts, I have configured logging to terminal monitor as I am connected to management port but don't get any alerts, ddns update is configured for every 2 minutes for now to see if it works.

Any help would be great.

[Blackbird2018]

Hi Balaji

Sorry didn't realise asa had a build in packet capture function, am I just capturing traffic on NBN interface going out to the internet and the protocol should I use IP or http and is there any other setting you can think of that I would need to narrow it down to ddns requests.

Thanks

[balaji.bandi]

i would suggest to RAW capure to understand what is wrong...

[Blackbird2018]

Hi Balaji

I did a packet capture, I used NBN as Ingress than changed it to Egress, settings I used is attached, I saw DHCP requests, SNMP and UDP requests but did not see anything for DDNS, it seems that the asa is not even trying to contact my ddns provider to update the IP, not sure why this is the case.

Thanks

[Blackbird2018]

Hi All

Has anyone setup ddns lately on any provider, does not have to be dynu, I just need the config to compare it with mine to see if I am missing something, I need details so just replace username and password from the config and was there any other steps that was done to make it work.

Thanks

[balaji.bandi]

i have posted on other day working config ?  if you still have issue contact your DDNS provider could help you, what is wrong.

Suggest to understand problem by doing WIRESHARK on the outside interface.

[Blackbird2018]

Hi Balaji

I have contacted dynu they don't know who to configure the asa for ddns update.

The config you provided is that all that is required to get it to work, how old is that config ?

I have done wireshark capture and attached settings I used for capture and don't see any traffic for ddns, looks like asa is not sending request out.

Thanks

[balaji.bandi]

this was year old config, it works. we do not change that config as frequent as if required to change.

That means from outside interface that is not intiating the connection. or something blocking.

Now sure we received your capture, may worth looking your ACL rules for this for incoming traffic also.

at this stage not much i can offer, until we see your config of ASA full, when i get chance we need to simulate the issue my ASA and come back to you, but not sure when for now - if you have cisco contract contact tac directly calling, they jump on call diagnosis for you.

[Blackbird2018]

Hi Balaji

I don't have a cisco contract, did you use any acl when you configured ddns, if yes can you tell me what it was.

There is no issue going out as I can assess the dynu api via a laptop connected directly to the asa.

If you have time I can send my whole config to you, can you provide me with an email address or a cloud link (google drive, one drive etc) where I can upload it for you to take a look.

Thanks

[balaji.bandi]

you can send me the config we can verify here. 

when you intiate then connecton from inside if the page is success, it will do NAT success, But if you intiate connection from outside interface we need to look your rules.

may be add same config in test envirionment and required testing.

[Blackbird2018]

Hi Balaji

I have attached the config, I have removed crypto config as that is not required and have changed some areas to xxxx which contain username and password and hostname.

Thanks

[Blackbird2018]

Hi Balaji

Did you manage to load my config and re-produce the issue.

Thanks

[balaji.bandi]

Sorry it was slipped from my list, next week when i get chance we will replicate and get back to you.

[Blackbird2018]

Hi Balaji

Did you manage to load my config and test it.

Thanks

[balaji.bandi]

offsite for now..no chance afraid for now.

[Blackbird2018]

Hi All

Anyone else in the Cisco community can provide any assistance, there are other people having the same issue.

Thanks