When +/- 800 PCs do a DNS lookup for a domain that does not exist to 8 regional DNS servers which in turn query 2 main DNS servers, the amount of connections for 1 of the DNS servers on the PIX arein excess of 75000 connections, killing the CPU of the PIX running ver 6.3(4).
Is there any way of stopping or limiting the amount of connections the PIX will open for the 2 main DNS servers?
you have a parameter called max_conns on the static nat statement. you can set this and the pix will block any tcp or udp connections once that number is reached.... you can probably create seperate statics for each dns server and give this limit... just note that any valid dns request after this number will also get dropped. so make sure you define the correct number...
Check the timeout value configured for UDP connections ,PIX should clear the idle DNS [UDP] connections on its own ,however if you have so many UDP connections then you may be hitting a BUG which was for DNS connections not cleared by pix .it was in 6.2.x ,.
check the "show conn detail" and check whats the idle time for these connections ,if its more than 2 min [which is default timeout value for UDP ] then you are definitely hitting the bug.
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...