Firepower 1140 DNS hostname resolution issue

[Singh007]

I have Firepower 1140 running ASA code 9.14.1 .

when i ping 8.8.8.8 its happening but when i ping wwwogoogle.com or tools.cisco.com its not pinging.

i have attached the log files along with debug dns as attachment for reference , let me know what i can do

i have configured default DNS for domain lookup outside for dns 8.8.8.8, 4.2.2.2, 208.67.222.222 208.67.220.220.

Need some help Since TAC has refused assistance as this is a new deployment. 

[Singh007]

attached file for reference

[Singh007]

i have tried to ping tools.cisco.com ip 72.163.4.38 and its working and attached in the file for reference

[Singh007]

i also tried doing packet-tracer for 8.8.8.8 but hitting implicit deny:

packet-tracer input outside udp 103.48.47.20 56789 8.8.8.8 53 detailed

Phase: 1
Type: INPUT-ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
Found next-hop 103.48.47.1 using egress ifc outside

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fd6b645cb90, priority=501, domain=permit, deny=true
hits=8, user_data=0x7, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=103.48.47.20, mask=255.255.255.255, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any,, dscp=0x0
input_ifc=outside, output_ifc=any

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule, Drop-location: frame 0x000055c94e727680 flow (NA)/NA

[MHM Cisco World]

DNS UDP port 53 is closed according to above packet tracer, 
there is any ACL apply to INside interface ?

[Aref Alsouqi]

You should specify the inside interface in the packet tracer not the outside one. Also, could you please try to remove the domain name from the DNS group and try again?

[MHM Cisco World]

totally correct He must use INside not OUTside

[MHM Cisco World]

you control this FPR with FMC ?

[Singh007]

this is a new implementation, the two other firewalls fpr 1010 is working fine with same DNS config. But this is not working.

This will be managed by ASDM , but currently its working only via CLI

[MHM Cisco World]

Share full config if you use cli

Thanks 

MHM