Guest

Preview Tool

Cisco Bug: CSCup95504 - ASA drops DNS PTR Reply w/ reason Label length exceeded during rewrite

Last Modified

Nov 27, 2020

Products (2)

  • Cisco Adaptive Security Appliance (ASA) Software
  • Cisco Adaptive Security Appliance (ASA) Software

Known Affected Releases

9.0(4.2) 9.1(2) 9.1(3) 9.1(4) 9.1(4.5) 9.1(5) 9.3(1)

Description (partial)

Symptom:
ASA running version 9.0.1 and above drops DNS PTR Reply.

Conditions:
1. ASA is configured for DNS inspection. 
2.The DNS PTR Record in the reply packet is subjected to rewrite. This happens when "dns" keyword is configured on the NAT for which PTR query is done.
3. Reply contains at least one Additional Record along with an Authoritative NS. If it is not present, but there is just an Authoritative NS, ASA corrupts the reply.
4. The real IP and translated IP in the NAT statement are of different length when written in decimal system.
Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.