DNS server assignment through DHCP

I think you need the "import all" command. Take a look at

I have a follow up to this question that perhaps you can assist me with. I came across a link on oreillynet.com that listed some common access-list pitfalls. On this page they state, "A second common access-list pitfall is when people forget to allow DNS from their internal network to the provider's DNS servers." Then they give an example of an access-rule to correct this:

access-list 110 permit udp host 172.16.1.1 eq domain any gt 1023

Why do you need an explicit rule to your ISP's DNS servers? Aren't all outgoing connections permitted by default? Thanks for your help.

-Vincent

Yes, all outgoing traffic is allowed by default (i.e. when no ACLs are applied).

I am guessing that what the article you referred to is talking about the case where users apply an outbound ACL and then forget to put in an ACL entry to allow DNS. Note that once an ACL is applied to an interface, then any packets not explicitly allowed by the ACL are denied. That is why you need to explicitly allow DNS (if that is necessary) for the case when an ACL is applied to the interface. If no ACL is applied, then as you indicated all packets are allowed by default.

Cisco da Gama

This looks more like an addition to the inbound ACL. The source in this line is the ISP's DNS server and the destination is the local network.

If you have an inbound ACL then often this can stop DNS working correctly as the outgoing request will get to the DNS server but the inbound reply will be blocked by the ACL. In the acl line above the source is port 53 (the source port from the server) and the destination is 'gt 1023', ie. the port that the server will talk back to the client on. In addition to this I would add a TCP 53 rule as well to allow TCP DNS requests in case the UDP reply is truncated.

Chris.