I ran across this post today and it helped me solve a similiar problem. This command works great except it specifies TCP, it should be UDP and the default ASA service for DNS is actually called domain.This revised command should get you what you need...
We are running an ASA 5525-X (not in production) with IPS SSP Module running at IPS version 7.1(6)E4 and are seeing the same behavior. CPU 100%Inspection load 0It seems like this might still be a bug, but none of the release notes indicate that the b...