I have a Cisco ASA using FQDN egress ACLs for a host that changes IP addresses every 10 mins (Apple APNS IP address pool). As soon as the TTL expires for the addresses, my internal server requests a new set of addresses and begins to use those. The ASA however, will not update the addresses for an additional minute due the minimum default DNS expire-entry-timer. Therefore every 10 mins I get a one minute window of failed connections until the ASA updates it's IP address cache from the DNS. I have tried using

no expire-entry-timer minutes

but this just sets the timer back to the default minimum of 1 minute.

Is there a way to force the ASA to request an update as soon as the TTL expires, or disable the expire-entry-timer all together?

  • 1
    Is the host changing IPs under your control? Is the list of IPs in a predictable set or subnet? Is this an ingress or egress rule? – Darrell Root Nov 1 '19 at 1:25
  • 1
    Why in the world would you have a server, or any host, that changes IP address every 10 minutes? That seems like it is just asking for problems. – Ron Maupin Nov 1 '19 at 3:08
  • No, I do not have control over the IP addresses; they are fetched from an IP address pool provided for Apple's APNS servers. The ACL is for egress traffic. There is also a reluctance to just open the whole subnet or for that matter. I'll clarify this in my question, thanks. – Pobbel Nov 1 '19 at 3:55
  • Apple has some documentation identifying ports but not specific address blocks at developer.apple.com/library/archive/technotes/tn2265/… In addition to the DNS-based permit I’d suggest some static permits to small blocks that you’ve found are included: that’s likely to increase your reliability from 90% to 99%. A couple /24 blocks are identified at stackoverflow.com/questions/10688852/… but that list does not include anything inside 17.188.x.x. – Darrell Root Nov 1 '19 at 4:55

After doing some further research, it seams that currently it is not possible to either prevent the ASA from extending the TTL or to force the ASA to renew IP addresses when the original TTL expires. In fact, there is a bug submitted for this particular problem at the following link. https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuq61154

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.