The issue that I am facing is the following:
I have configured a vm Ubuntu and the machine isn't able to resolve DNS records with my internal DNS server. "The DNS server is a windows_server_2008_R2 AD/DNS combo"
The topology:
Ubuntu configuration:
root@rboshmaf-ubuntu:~# cat /etc/network/interfaces
interfaces(5) file used by ifup(8) and ifdown(8)
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 192.168.1.12
netmask 255.255.255.0
dns-nameservers 172.16.1.11 144.254.71.184
gateway 192.168.1.1
root@rboshmaf-ubuntu:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
link-local * 255.255.0.0 U 1000 0 0 eth0
192.168.1.0 * 255.255.255.0 U 0 0 0 eth0
root@rboshmaf-ubuntu:~# cat /etc/resolv.conf
Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 172.16.1.11
nameserver 144.254.71.184
The vm wimdows_7 machine that is in the same network as the Ubuntu "using the same DNS server" is able to get the results.
ASA configuration "traffic going from high > low security, required inspection is in place"
Took captures on the ASA to see what is happening, the weird thing that I saw was the fact that in Ubuntu "not working situation" the query is going to 1.1.168.192.in-addr.arpa
In windows "working situation" the query is going to 1.1.16.172.in-addr.arpa
keep in mind that the windows server IP is 172.16.1.11 and the DNS records are all there 
ping\nslookup from windows_7
C:\Users\administrator>ping 172.16.1.11
Pinging 172.16.1.11 with 32 bytes of data:
Reply from 172.16.1.11: bytes=32 time=1ms TTL=128
Ping statistics for 172.16.1.11:
Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 1ms, Average = 1ms
Control-C
^C
C:\Users\administrator>nslookup rboshmaf-ubuntu 172.16.1.11
Server: win-o33saf37ksq.raedlab.local
Address: 172.16.1.11
Name: rboshmaf-ubuntu.raedlab.local
Address: 192.168.1.12
ping\nslookup fom Ubuntu
root@rboshmaf-ubuntu:~# ping 172.16.1.11
PING 172.16.1.11 (172.16.1.11) 56(84) bytes of data.
64 bytes from 172.16.1.11: icmp_seq=1 ttl=128 time=1.25 ms
^C
--- 172.16.1.11 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.258/1.258/1.258/0.000 ms
root@rboshmaf-ubuntu:~# nslookup rboshmaf-ubuntu 172.16.1.11
Server: 172.16.1.11
Address: 172.16.1.11#53
** server can't find rboshmaf-ubuntu: SERVFAIL
What I don't like in the capture is the fact that Ubuntu query is going to 1.1.168.192.in-addr.arpa which isn't the DNS server "in fact 192.168.1.1 is the GW for Ubuntu "inside interface of the ASA"
Any ideas or suggestion about the situation.
Thanks!
edit #1
Just to remove the ASA from the picture, I reconfigured the Topology as following:
New Ubuntu configuration:
root@rboshmaf-ubuntu:~# cat /etc/network/interfaces
# interfaces(5) file used by ifup(8) and ifdown(8)
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 172.16.1.12
netmask 255.255.255.0
dns-nameservers 172.16.1.11 144.254.71.184
gateway 172.16.1.1
root@rboshmaf-ubuntu:~# ifconfig
eth0 Link encap:Ethernet HWaddr 00:50:56:99:3c:b3
inet addr:172.16.1.12 Bcast:172.16.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:20756 errors:0 dropped:0 overruns:0 frame:0
TX packets:6959 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:29614255 (29.6 MB) TX bytes:480744 (480.7 KB)
root@rboshmaf-ubuntu:~# cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by
resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 172.16.1.11
nameserver 144.254.71.184
root@rboshmaf-ubuntu:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use
Iface
default 172.16.1.1 0.0.0.0 UG 0 0 0
eth0
link-local * 255.255.0.0 U 1000 0 0
eth0
172.16.1.0 * 255.255.255.0 U 0 0 0
eth0
ping/nslookup from Ubuntu
root@rboshmaf-ubuntu:~# ping 172.16.1.11
PING 172.16.1.11 (172.16.1.11) 56(84) bytes of data.
64 bytes from 172.16.1.11: icmp_seq=1 ttl=128 time=1.23 ms
64 bytes from 172.16.1.11: icmp_seq=2 ttl=128 time=0.811 ms
64 bytes from 172.16.1.11: icmp_seq=3 ttl=128 time=0.981 ms
^C
--- 172.16.1.11 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2001ms
rtt min/avg/max/mdev = 0.811/1.007/1.231/0.176 ms
root@rboshmaf-ubuntu:~# nslookup rboshmaf-ubuntu 172.16.1.11
Server: 172.16.1.11
Address: 172.16.1.11#53
** server can't find rboshmaf-ubuntu: SERVFAIL
capture for the ASA confirming no traffic reached the ASA
rboshmaf-asa# capture cap1 interface dmz match ip h 172.16.1.12 h 172.16.1.11
rboshmaf-asa# show capture
capture cap1 type raw-data interface dmz [Capturing - 0 bytes]
match ip host 172.16.1.12 host 172.16.1.11
And I took tcpdump on ubuntu
root@rboshmaf-ubuntu:~# tcpdump -n -i eth0 | grep 172.16.1.11.53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
10:17:07.417553 IP 172.16.1.12.54685 > 172.16.1.11.53: 43282+ A? rboshmaf-ubuntu. (33)
10:17:07.418939 IP 172.16.1.11.53 > 172.16.1.12.54685: 43282 ServFail 0/0/0 (33)
10:17:27.270067 IP 172.16.1.12.56675 > 172.16.1.11.53: 50648+ A? ntp.ubuntu.com. (32)
10:17:27.270803 IP 172.16.1.11.53 > 172.16.1.12.56675: 50648 3/0/0 A 91.189.89.198, A 91.189.89.199, A 91.189.91.157 (80)
And the local capture from the windows_server
Thanks!
Best Answer
My guesses are:
telneton port53to test this./etc/hostsfrom Ubuntu, might have a local record which might create a conflict.