FWSM Critical message

[jaravinthan]

Hi,

below is the message i get from FWSM. The IP's always change but what i see is its always any of the Windows DC's located across globe.

2007-10-26 00:42:18 Local4.Critical <FWSM IP> Oct 26 2007 00:42:51: %FWSM-2-106007: Deny inbound UDP from <IP/53> to <IP/dynamic port> due to DNS Response

Any clue on what could cause and why suddenly these message bombard in the logs. We have DNS inspect enabled since scratch. Please advice.

[palomoj]

it sounds like a valid dns response has already been detected and allowed through the firewall. i would do some testing and see if this is the case. you may need to do a packet capture and verify this.