%PIX-4-410001: Dropped UDP DNS reply from outside:x.x.x.x/53 to

inside:y.y.y.y/49746; packet length 768 bytes exceeds configured limit of 512

I was wondering what might be the reason, then figured out the packets received from ISP is of 768 bytes whereas by default the Cisco PIX 525 Firewall allows 512 bytes as shown below.

The problem was with the default DNS inspection policy-map. By default in Cisco PIX 525, Cisco ASA it’s configured to 512 bytes

The moment I changed the default DNS inspection policy-map from 512 bytes to 1000 bytes things were normal the Windows 2008 R2 Server was resolving the DNS queries.

The commands I used to change the default DNS inspection policy-map is as follows.

MBGF-DAC-525-FW01# configure t

MBGF-DAC-525-FW01(config)# class-map inspection_default

MBGF-DAC-525-FW01(config-cmap)# match default-inspection-traffic

MBGF-DAC-525-FW01(config-cmap)# policy-map global_policy

MBGF-DAC-525-FW01(config-pmap)# class inspection_default

MBGF-DAC-525-FW01(config-pmap-c)# inspect dns maximum-length 1000

MBGF-DAC-525-FW01(config-pmap-c)#

In windows 2008 Server we have specified the DNS forwarder as shown in the below diagram.

But it always fails to resolve the DNS queries from internal network to external network using nslookup command from the command prompt of the Windows 2008 Server as well when we are testing the simple and recursive query to other DNS Servers it’s failing as demonstrated below

We have done the following to

1)      The internal IP address for the Windows 2008 R2 server is PATed in our PIX 525 Firewall, I could browse the internet.

2)      In Windows 2008 R2 Server we have specified the DNS IP Address provided by our ISP.

3)      All our servers in the DMZ zone are working fine.

I am working on this issue; meanwhile if any one of you knows who to resolve this issue, your comments are always welcomed.

According to Cisco Systems, the Cisco® CRS-3 Carrier Routing System (CRS) the entire population of the China can make a video call at once , the entire printed collection of the Library of Congress to be downloaded in just over one second; . Every single motion picture ever created can be streamed in less than four minutes.

Pic Courtesy:Cisco Systems

The Cisco® CRS-3 Carrier Routing System (CRS) – designed to serve as the foundation of the next-generation Internet and set the pace for the astonishing growth of video transmission, mobile devices and new online services through this decade and beyond.

With more than 12 times the traffic capacity of the nearest competing system, the Cisco CRS-3 is designed to transform the broadband communication and entertainment industry by accelerating the delivery of compelling new experiences for consumers, new revenue opportunities for service providers, and new ways to collaborate in the workplace.

Overview:

• The Cisco CRS-3 triples the capacity of its predecessor, the Cisco CRS-1 Carrier Routing System, with up to 322 Terabits per second, which enables the entire printed collection of the Library of Congress to be downloaded in just over one second; every man, woman and child in China to make a video call, simultaneously; and every motion picture ever created to be streamed in less than four minutes.
• The Cisco CRS-3 enables unified service delivery of Internet and cloud services with service intelligence spanning service provider Internet Protocol Next-Generation Networks (IP NGNs) and data center.  The Cisco CRS-3 also provides unprecedented savings with investment protection for the nearly 5,000 Cisco CRS-1 deployed worldwide.  Cisco’s cumulative investment in the Cisco CRS family is $1.6 billion, further underscoring the company’s commitment.
• AT&T, one of the world’s largest telecommunications companies, recently tested the Cisco CRS-3 in a successful completion of the world’s first field trial of 100-Gigabit backbone network technology, which took place in AT&T’s live network between New Orleans and Miami.  The trial advances AT&T’s development of the next generation of backbone network technology that will support the network requirements for the growing number of advanced services offered by AT&T to consumer and business customers, both fixed and mobile.
• The Cisco CRS-3 is currently in field trials, and its pricing starts at $90,000 U.S.