Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

Super Bronze

FWSM 3.2(6) DNS Problem


I have a situation where IT support are saying that a couple of customer computers are expiriencing problems with connections. There has been situations in the past where its been related to DNS (DNS traffic was dropped due to the size which we had to increase in the "inspect" rules)

Now I am regularly seeing alot of log messages of DNS traffic beeing dropped and I cant figure out what the actual problems is.

Basicly the customer has a L2 connection directly to the FWSM context. They naturally have a link to the Internet and also a DMZ with DNS server and some other services running.

Now what I see is error messages about DNS replies from the DMZ server to the LAN hosts

The actual log message might be something like this

Feb 13 2012 14:03:38 CONTEXT-NAME : %FWSM-2-106007: Deny inbound UDP from to due to DNS Response

The inside hosts are mostly configured with DHCP straight from the FWSM context. They only have one assigned DNS server which is the DMZ server above (

Now if I am reading the description for this syslog message correctly, this error message should usually imply that there is more than 1 DNS server beeing used by some host/server?

Still I am watching the syslog messages in real time and I can only see the LAN hosts DNS traffic to the server and the DNS server traffic to ISPs DNS servers. I cant see the LAN host sending any DNS querys to a public DNS server.

Any idea what could be causing this. I found one post on these very forums about similiar issue (atleast same error message) but I dont think the situation was exactly the same.

- Jouni

  • Firewalling