Skip to main content

Cisco ASA 5505 and EDNS issue

resolution: update your running config on your firewall. See below

issue:
I changed my primary internal DNS to run on a RHEL 6.2 system. After that there were noticeable lags occasionally when I would browse.  Upon review of the syslog I noticed messages like the following;

Jan 31 22:44:41 zion named[26381]: success resolving 'p03-bookmarks.icloud.com/A' (in 'icloud.com'?) after reducing the advertised EDNS UDP packet size to 512 octets

I happen to use a Cisco ASA 5505 and I did some digging around.

firewall(config)# show run | grep mess
  message-length maximum 512

So - it turns out the value is set as part of a policy-map.  Let's tune it.


firewall(config)# policy-map type inspect dns preset_dns_map
firewall(config-pmap)# parameters
firewall(config-pmap-p)# no message-length maximum 512
firewall(config-pmap-p)# message-length maximum 4096
firewall(config-pmap-p)# 
firewall(config-pmap-p)# write mem
Building configuration...
Cryptochecksum: 3a1cdf20 91ce7d1e d8b188fc 1ac006fb 


4215 bytes copied in 1.420 secs (4215 bytes/sec)
[OK]
firewall(config-pmap-p)# 

Everything is better... now I just get these errors (and nothing on my side will fix this issue)
Jan 31 22:46:30 zion named[26381]: error (network unreachable) resolving 'thumbnail.newsinc.com/A/IN': 2001:500:90:1::18#53


Labels:

Comments

Post a Comment

Popular posts from this blog

PXE boot a LiveCD image

Summary: I have wanted to build a kickstart environment which hosted a "rescue CD" or LiveCD to allow you to boot over the network after you blew your stuff up and needed to repair a few things.  Today I have worked through a method of doing so, with the help of the people who published a succinct script with the Red Hat Enterprise Virtualization Hypervisor.  (the script will be at the bottom of this post - if I have somehow not followed the GPL, please let me know and I will correct whatever is necessary) NOTE/Warning: The boot will fail due the initrd being too large (645mb).  I'm not sure how to proceed.  This procedure worked for RHEVh, because it is quite a bit smaller.  Hopefully I can report back with progress on this? :-$ Procedure: download your LiveCD image to /export/isos/RESCUE/Fedora-16-i686-Live-Desktop.iso # cd /var/tmp # vi livecd-iso-to-pxeboot (populate the file with the script shown below) # chmod 754 ./livecd-iso-to-pxeb...
2 comments
Read more

"Error getting authority: Error initializing authority: Could not connect: No such file or directory (g-io-error-quark, 1)"

"Error getting authority: Error initializing authority: Could not connect: No such file or directory (g-io-error-quark, 1)" One issue that may cause this to arise is if you managed to break your /etc/fstab We had an engineer add a line with the intended options of "nfsvers=3" but instead added "-onfsvers=3" and it broke the system fairly catastrophically.
Post a Comment
Read more

MOTD with colors! (also applies to shell profiles)

I'm not sure why I had never looked into this before, but this evening I became obsessed with discovering how to present different colored text in the /etc/motd. A person had suggested creating a shell script (rather than using special editing modes in vi, or something) and I agree that is the simplest way of getting this accomplished quickly. This most noteworthy portion of this script is the following: RESET="\033[0m" that puts the users shell back to the original color. I typically like a green text on black background. Also - a great reference for the different colors and font-type (underscore, etc...) https://wiki.archlinux.org/index.php/Color_Bash_Prompt I found this example on the web and I wish I could recall where so that I could provide credit to that person. #!/bin/bash #define the filename to use as output motd="/etc/motd" # Collect useful information about your system # $USER is automatically defined HOSTNAME=`uname -n` KERNEL=`un...
1 comment
Read more