ASA 5510 Slow Name Resolution

Answered Question
Sep 10th, 2010
User Badges:

Greetings.


I have a problem. We're planning to add an ASA into our network for VPN and firewall purposes. I've hooked the ASA up to the network and so things look a bit like this:-


Bridged Internet Connection --->> ASA 5510 --->> 1841 Router --->> Network


We currently use a different firewall appliance which is still connected. The problem is, when I switch the route to go out onto the internet to pass through the ASA, DNS resolutions become slow. They work but they are slow and thus browsing is slow. When I set the route back to the other firewall appliance, everything works fine. The resolutions are much quicker than when the traffic is running through the ASA.


By the way, the DNS server is internal.


Can anyone share some insight into why this happens? Did I forget something? I've attached the ASA's configuration.

Correct Answer by Panos Kampanakis about 6 years 10 months ago

I would suggest enabling dns inspection.


If that doesn't help I would suggest using the capture command to capture packets in and out of the ASA so you can see who delays or drops the dns.


Also check the interfaces for duplect or speed mismatches that could cause drops and delays.


I hope it helps.


PK

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Panos Kampanakis Fri, 09/10/2010 - 11:31
User Badges:
  • Cisco Employee,

I would suggest enabling dns inspection.


If that doesn't help I would suggest using the capture command to capture packets in and out of the ASA so you can see who delays or drops the dns.


Also check the interfaces for duplect or speed mismatches that could cause drops and delays.


I hope it helps.


PK

Felix Bowman Tue, 09/14/2010 - 07:17
User Badges:

Thank you. I got the problem solved after doing some packet captures.


It turns out that the DNS server was forwarding to two other older DNS servers that we had before. That caused the resolutions to take much longer than they should have which timed out on the client machines.


The captures showing the older DNS servers making resolution requests whenever a lookup request was made from the new DNS server.


I appreciate your help on the matter.

Panos Kampanakis Tue, 09/14/2010 - 07:48
User Badges:
  • Cisco Employee,

Thank you for updating. That way other will benefit in the future.


PK

Actions

This Discussion