DNS zone transfer through PIX

[mbrown]

Does anyone have any tips on permitting DNS zone transfers through the PIX? We have a business partner with whom we are trying to configure this. Each network is behind a PIX. We have tried using access-lists that permit the specific port (53) for both tcp and udp. This has not worked.

[yusuff]

permitting UDP 53 should be sufficient for the zone transfer ....

some pointers

- double check the static/conduit/ACL on the pix...

- apply conduit permit tcp any any "and" udp any any and see if it works, if not, perhaps its not the PIX issue... if it does, then you know its the ACL/conduit

- check the logs? do you see any denies for UDP 53??

Hope that helps

R/Yusuf