@Rob Ingram @Marius Gunnerud
Here's the output from the packet tracker, the dns server does not get a reply but the trace logs dont show anything being blocked.
1: 20:20:21.581055 192.168.1.10.48746 > 8.8.8.8.53: udp 28
Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Elapsed time: 11296 ns
Config:
Additional Information:
MAC Access list
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Elapsed time: 11296 ns
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 3
Type: INPUT-ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Elapsed time: 3530 ns
Config:
Additional Information:
Found next-hop 38.140.221.81 using egress ifc wan(vrfid:0)
Phase: 4
Type: OBJECT_GROUP_SEARCH
Subtype:
Result: ALLOW
Elapsed time: 0 ns
Config:
Additional Information:
Source Object Group Match Count: 4
Destination Object Group Match Count: 1
Object Group Search: 0
Phase: 5
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Elapsed time: 0 ns
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit udp object-group DNSServers any object-group DNS_over_UDP rule-id 268436488
access-list CSM_FW_ACL_ remark rule-id 268436488: ACCESS POLICY: FTD-Mig-ACP-1694711294 - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268436488: L7 RULE: Allow-From-DNS-Servers
object-group network DNSServers(hitcnt=1392, id=4026531841)
network-object object DNSServer2(hitcnt=22)
network-object object DNSServer1(hitcnt=1370)
network-object object DNSServer3(hitcnt=0)
object-group service DNS_over_UDP udp
port-object eq domain
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached
Phase: 6
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Elapsed time: 0 ns
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:
Phase: 7
Type: NAT
Subtype: per-session
Result: ALLOW
Elapsed time: 0 ns
Config:
Additional Information:
Phase: 8
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Elapsed time: 0 ns
Config:
Additional Information:
Phase: 9
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Elapsed time: 9178 ns
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
service-policy global_policy global
Additional Information:
Phase: 10
Type: NAT
Subtype: per-session
Result: ALLOW
Elapsed time: 7766 ns
Config:
Additional Information:
Phase: 11
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Elapsed time: 0 ns
Config:
Additional Information:
Phase: 12
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Elapsed time: 4236 ns
Config:
Additional Information:
New flow created with id 1229380, packet dispatched to next module
Phase: 13
Type: EXTERNAL-INSPECT
Subtype:
Result: ALLOW
Elapsed time: 6354 ns
Config:
Additional Information:
Application: 'SNORT Inspect'
Phase: 14
Type: SNORT
Subtype: appid
Result: ALLOW
Elapsed time: 83433 ns
Config:
Additional Information:
service: DNS(617), client: DNS(617), payload: (0), misc: (0)
Phase: 15
Type: SNORT
Subtype: SI-DNS
Result: ALLOW
Elapsed time: 8091 ns
Config:
DNS policy 862867808, Allow
Additional Information:
Matched domain google.com, action Allow
Phase: 16
Type: SNORT
Subtype: firewall
Result: ALLOW
Elapsed time: 32306 ns
Config:
Network 0, Inspection 0, Detection 0, Rule ID 268436488
Additional Information:
Starting rule matching, zone 1 -> 8, geo 0 -> 0, vlan 0, src sgt: 0, src sgt type: unknown, dst sgt: 0, dst sgt type: unknown, user 9999997, urls , hosts google.com, no xff
Matched rule ids 268436488 - Allow
Phase: 17
Type: INPUT-ROUTE-LOOKUP-FROM-OUTPUT-ROUTE-LOOKUP
Subtype: Resolve Preferred Egress interface
Result: ALLOW
Elapsed time: 2824 ns
Config:
Additional Information:
Found next-hop 38.140.221.81 using egress ifc wan(vrfid:0)
Phase: 18
Type: ADJACENCY-LOOKUP
Subtype: Resolve Nexthop IP address to MAC
Result: ALLOW
Elapsed time: 353 ns
Config:
Additional Information:
Found adjacency entry for Next-hop 38.140.221.81 on interface wan
Adjacency :Active
MAC address e0ac.f127.b0ae hits 203 reference 29
Result:
input-interface: lan(vrfid:0)
input-status: up
input-line-status: up
output-interface: wan(vrfid:0)
output-status: up
output-line-status: up
Action: allow
Time Taken: 180663 ns
