Description

This article explains a scenario where intermittent DNS response timeout reported after configuring and applying a firewall filter. 

 

#show firewall family inet filter SERVER_OUT_IPV4_FILTER term UDP_ALL               

    from {

        protocol udp;

        destination-port [ 53 49152-65535 ];

    }

    then accept;

 

set interfaces xe-2/1/0 unit 0 family inet filter output SERVER_OUT_IPV4_FILTER 

set interfaces xe-2/1/0 unit 0 family inet6 filter output SERVER_OUT_IPV4_FILTER 

Solution

The incorrect configuration allows DNS responses to pass only if they are destined for port 53 or within the range of 49152-65535. 

Modification History

2024-12-12 : Article Created