[nsp] PIX deny UDP

[Zhang, Anchi]

Is 10.10.10.1 statically translated from inside to outside?  -anchi

-----Original Message-----
From: odusseus [mailto:odusseus@voila.fr]
Sent: Monday, October 14, 2002 6:52 AM
To: cisco-nsp
Subject: [nsp] PIX deny UDP


Hi,

In order to allow external hosts to reach my DNS server I add this few =
lines on the PIX (515, IOS 6.2(1)):

conduit permit udp host 10.10.10.1 eq 53 any
conduit permit udp host 10.10.10.1 any  eq 53

When I send a DNS request from an internal host, without passing through =
the PIX, it works fine.

But I when I send a DNS request from an external host, it has to pass =
through the PIX and it failed.
The host does not receive any answer due to timeout (5sec), although the =
udp timeout from the PIx has been set up to 2 min.

I got the following log message from the PIX:

%PIX-2-106007: Deny inbound UDP from 192.168.1.1/4168 to 10.10.10.1/53 =
due to DNS Query

When I run a tcpdump on the DNS server, I have no trace of any incoming =
packets so I conclude that the PIX is stopping this traffic.

Why is the PIX is behaving this way?

If someone has any idea to share, he is very much welcome.

Thank you.

Regards,

Christophe
------------------------------------------

Faites un voeu et puis Voila ! www.voila.fr=20

_______________________________________________
cisco-nsp mailing list  real_name)s@puck.nether.net
http://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/