Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
Hi,I have a network protected by a pair of ASA 5520, running 8.04.I do pretty much default dns inspection:policy-map type inspect dns preset_dns_map parameters message-length maximum 1024policy-map global_policy class inspection_default ... inspec...
Either I am misunderstanding something, or there is a bug somewhere.I import my grt into a vrf via a import ipv4 unicast map setup.Everything works fine (except in 12.4-22T2, where it seems to be broken, but that's another issue) at first.The grt con...
Thank you both for your help.I'll try an upgrade to 8.2 (which will take a little while, as I have no smartnet yet for this device) and report the results here.Blaise
After a little bit of diggin, it turns out the dns response actually perfectly respects the rfc.If a packet is bigger than 512 (and the client didn't specify that it supported a larger than 512 payload), the server is supposed to return a truncated p...
Thanks,but unfortunately again, no luck : it doesn't change a thing.I already tried "no dns-guard', and "no protocol-enforcement", but the packets are still getting dropped.Blaise
Tanks for your suggestion.Unfortunately, it doesn't work.I believe the match clause inside the policy map is to specify other kind of actions (drop / log / etc...)And the match not domain-name regex example will correctly match anything but test.test...
Thanks.When I wrote my question, I thought I could disable dns inspection for that domain, but I can't quite figure out how.The only thing that works is to completely turn off dns inspection (not just have a different policy with protocol enforcement...
