ASA - UDP Connections Remaining Open

Hi Guys,

We are currently having an issue where UDP Connections are not timing out specifically around our DNS calls.

We have our connection limit set to 5000 and our Internal DNS Server continues to hit this on an almost hourly basis.

When I run a "sh conn count", I can see in excess of 5,000 UDP connections from the DNS Server to servers on the web.

The CONNS-POLICY looks as follows:

policy-map CONNS-POLICY
 class CONNS-MAP
  set connection per-client-max 5000 per-client-embryonic-max 2000 
  set connection timeout idle 2:00:00 dcd 
!

Open in new window


Timeout information is as follows:

timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00

Open in new window


I am not sure how to best approach allow the DNS traffic outbound or how others have managed such an issue.

Your input would be appreciated.
maccaduAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

gheistCommented:
But you keep STATE (*) open for 2 hours!!! Check with your DNS server defaults, but normally it stops waiting for response in 5..60s depending on its age.

(*) UDP is connectionless, ther is no connection open or closing
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
gheistCommented:
Can you help me to understand what was wrong with my answer and DNS protocol description?
Do you have DNS responses that you get in 1-2h?
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.