What ACL will allow DNS through the ASA?

[professorguy]

I have 2 internal caching DNS machines which must get DNS requests out. I did this:

..
access-list acl_outside extended permit udp any host 192.168.7.250 eq domain
access-list acl_outside extended permit udp any host 192.168.7.251 eq domain
...
access-list acl_inside extended permit udp host 192.168.7.250 any eq domain
access-list acl_inside extended permit udp host 192.168.7.251 any eq domain
...
And there's also the standard policy_map stuff:
inspect dns map1 (with parameter message-length max 512).

But there are DNS problems on the inside: I can visit websites that my internal DNS servers have cached, but new ones can be seen only by IP.


What else needs to happen?

 

[Supergrrover]

You need to post your whole config to see what is going on, statics and the rest of the ACL's matter.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[professorguy]

I have no configuration for DNS traffic to pass, I'm starting from scratch so nothing is currently in the config.

What must be in the config for it to work. The above is my guess, but since you mention statics, I guess there's more required.

What is required? What does it look like?

 

[Supergrrover]

Here is a basic formula -

http://www.cisco.com/en/US/products...s_configuration_example09186a00807d287e.shtml

Now just change TCP 3389 to UDP 53 to switch it from RDP to DNS.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[professorguy]

So my 2 DNS machines must each have a public IP address from my tiny, precious pool of public IPs to work? This seems wrong to me. The only reason I say this is we currently have a PIX firewall and our current DNS works fine and we don't currently use up 2 public IPs to accomplish it.

In fact, in our current setup, I see the lines which allow egress (on acl_inside), but don't see any rules for ingress (on acl_outside) which deals with DNS. I thought that stateful inspection would allow responses automatically, but DNS is UDP so that's not true, is it?

And yet we have some systems which allow 3389 and those do have public IPs applied with static (inside,outside) ... But nothing analogous for DNS. Does the PIX do something fundamentally different than the ASA when dealing with DNS?

 

[Supergrrover]

So your DNS servers only serve internal clients? If so, then no you do not need to use any public IPs. You will just have to allow that traffic in the inside interface.
The stateful inspection will watch UDP traffic and go by source and destination IP.

To have any 2 servers of the same service available from the outside world you need 2 IPs. There is no way around it with just the firewall.



Brent
Systems Engineer / Consultant
CCNP, CCSP