×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

DNS Resolution in Cisco ASA 5525

Unanswered Question
Jan 21st, 2014
User Badges:

Hey all,


I will begin by telling you what my end goal is, I am trying to block specific websites on our cisco ASA 5525 using FDQN. I know that this functionality for DNS resolution was not implemented until a specific version.


Current Version: Cisco ASA 5525

ASA Version: 8.6(1)


I can ping external addresses from the ASA however I cannot ping hostnames like "ping google.ca" does not work.


What I've done.



dns domain-lookup inside

dns domain-lookup outside

name-server x.x.x.x (Primary internal dns server)

name-server x.x.x.x (Secondary internal dns server)

name-server 8.8.8.8 (Google external dns server)

name-server 8.8.4.4 (Google external dns server)

domain-name example.com


With this config I can, however, ping hostnames of internal servers.


This is an example of me pinging an external hostname.


ciscoasa# ping google.ca

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2607:f8b0:4009:803::101f, timeout is 2 seconds:

No route to host 2607:f8b0:4009:803::101f



Success rate is 0 percent (0/1)



Any ideas?


Thanks!

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
johnlloyd_13 Wed, 01/22/2014 - 00:20
User Badges:
  • Blue, 1500 points or more

hi jonathan,


could you try adding using the default DNS group?


dns server-group DefaultDNS

name-server x.x.x.x

name-server 8.8.8.8

name-server 8.8.4.4

domain-name example.com

Cityofrefuge7 Wed, 01/22/2014 - 05:53
User Badges:

Hi John,


Thanks for your quick reply.


I forgot to mention that I was adding the name servers and domain name to the DefaultDNS group already, though I did remove my secondary internal dns server to reflect exactly what you sent to me, unfortunately still no luck.

johnlloyd_13 Wed, 01/22/2014 - 06:43
User Badges:
  • Blue, 1500 points or more

Hi,

Could you post 'ping www.google.com' and 'show route' output?


Sent from Cisco Technical Support iPhone App

Cityofrefuge7 Wed, 01/22/2014 - 12:29
User Badges:

officeasa# ping www.google.com

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2607:f8b0:4009:802::1012, timeout is 2 seconds:

No route to host 2607:f8b0:4009:802::1012



Success rate is 0 percent (0/1)


John, due to the sensitive nature displayed within show route output, is there any other information I can tell you, what exactly did you need to see from this information?


(I know without certain information you cannot help but I need to ensure security on my end)


Thanks for understanding.

Actions

This Discussion