Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASA dropping UDP/53 traffic on inside interface

Greetings,

I've spent the better part of a week trying to pound this out.

We have a Cisco ASA 5505 (v7.2(3)) with a "fairly" normal configuration yet we have a problem where it appears UDP/53 traffic is denied on our inside network.

here is output from our sys log:

SyslogID   Source IP      Dest IP    Description

305006      172.18.22.3                   portmap translation creation failed for udp src inside:172.18.22.156/42013 dst inside:172.18.22.3/53

To give some clarification:

172.18.22.3      is one of our DNS servers

172.18.22.156  is a device we're experimenting with.

We've bypassed the Cisco by using a 4G wireless router with this same device - and it works flawlessly.

Here is a [scrubbed] copy of our config. It is what I inherited from the previous admin - I'm not sure of all its finer points (I'm not Cisco certified -- perhaps I'm just certifiable.)

Any help would be greatly appreciated.

-knme

: Saved

:

ASA Version 7.2(3)

!

hostname [redacted]

domain-name [redacted]

enable password [redacted] encrypted

names

!

interface Vlan1

nameif inside

security-level 100

ip address 172.18.22.6 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 999.999.999.999 255.255.255.248

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passwd [redacted] encrypted

ftp mode passive

clock timezone EST -5

clock summer-time EDT recurring

dns domain-lookup outside

dns server-group DefaultDNS

name-server 198.6.1.142

name-server 198.6.1.1

domain-name ocm.local

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list inside_nat0_outbound extended permit ip any 172.18.22.64 255.255.255.240

access-list outside_access_in remark inbound icmp

access-list outside_access_in extended permit icmp any any echo

access-list outside_access_in remark inbound icmp-echo-reply

access-list outside_access_in extended permit icmp any any echo-reply

access-list inside_access_in extended permit tcp any eq domain any eq domain

access-list inside_access_in extended permit udp any eq domain any eq domain

access-list inside_access_in extended permit tcp any any

access-list inside_access_in extended permit udp any any

access-list inside_access_in extended permit icmp any any echo

access-list inside_access_in extended permit icmp any any traceroute

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool ABC 172.18.22.70-172.18.22.74 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-523.bin

no asdm history enable

arp timeout 14400

nat-control

global (outside) 101 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 101 172.18.22.0 255.255.255.0

access-group inside_access_in in interface inside

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 65.215.53.161 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

aaa-server OCM protocol nt

aaa-server OCM host 172.18.22.2

timeout 5

nt-auth-domain-controller Fileserv

aaa authentication ssh console LOCAL

http server enable

http 172.18.22.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto dynamic-map outside_dyn_map 20 set pfs

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh 172.18.22.0 255.255.255.0 inside

ssh timeout 5

console timeout 0

dhcpd auto_config outside

!

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

  inspect pptp

  inspect icmp

  inspect http

  inspect icmp error

  inspect ipsec-pass-thru

!

service-policy global_policy global

ntp server 64.90.182.55 source outside prefer

group-policy ABC internal

group-policy ABC attributes

dns-server value 172.18.22.2 172.18.22.3

vpn-tunnel-protocol IPSec

default-domain value ABC

username admin password [redacted] encrypted privilege 15

tunnel-group ABC type ipsec-ra

tunnel-group ABC general-attributes

address-pool ABC

authentication-server-group ABC

default-group-policy ABC

tunnel-group ABC ipsec-attributes

pre-shared-key *

prompt hostname context

Cryptochecksum:5d3c117cfd8e54a4ba032de9330c51f9

: end

asdm image disk0:/asdm-523.bin

no asdm history enable

5 REPLIES
VIP Purple

ASA dropping UDP/53 traffic on inside interface

Without looking at your config: You need to find out why your client .156 sends the packets to the ASA when he wants to reach your internal DNS. As they are both in the same subnet, the ASA shouldn't see that traffic. Start your troubleshooting at the IP-config and routing-config of the client.


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

ASA dropping UDP/53 traffic on inside interface

Hello Karsten,

Thanks for a very prompt response. I do apreciate it.

Sadly I do not have access to the IP-config nor routing-config of the client. They're "black box units". They obtain IP address from our DHCP server - that is pretty much all I know about them.

Any other suggestions?

-knme

VIP Purple

Re: ASA dropping UDP/53 traffic on inside interface

Are there other clients with that problem? Have you doublechecked the DHCP-Scope?

Sent from Cisco Technical Support iPad App


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

Re: ASA dropping UDP/53 traffic on inside interface

Thanks again Karsten,

No - no other users.

Did discover that when pinging the device the reply is being rejected by the firewall. All are in agreement that this sort of traffic should not be seen at the firewall level so we're really not sure what is going on.

Almost seems like the subnet of the device does not match the subnet of the rest of the network but it is nearly impossible to check b/c the device is not capable.

-knme

VIP Purple

Re: ASA dropping UDP/53 traffic on inside interface

Are the other clients getting their IP-config also from the same DHCP-server? You can capture the packets that are directly leaving the problematic PC. If the destination-L2-address is the ASA, then the problem is in the client-config.


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
1230
Views
0
Helpful
5
Replies
CreatePlease to create content