FirewallDNS
    Enterprise Firewalls

    How to Change DNS on Cisco ASA / Firepower (FTD)

    By [FILL IN], [FILL IN] · Last updated

    Set FirewallDNS on the ASA DNS server group and DHCP scope.

    Before you start

    You need a FirewallDNS account (see pricing). Sign in to your dashboard, register your public IP address and copy your DNS server addresses. Replace <FIREWALLDNS-PRIMARY> and <FIREWALLDNS-SECONDARY> below with them.

    Step by step

    1. ASDM: Configuration > Device Management > DNS > DNS Client, edit DefaultDNS and add the FirewallDNS servers.
    2. Configuration > Device Management > DHCP > DHCP Server: set DNS Server 1 and 2.
    3. FMC (FTD): Devices > Platform Settings > DNS, create a DNS server group with FirewallDNS; for DHCP use Devices > Device Management > DHCP.
    4. Deploy changes.

    ASA CLI

    dns domain-lookup outside
dns server-group DefaultDNS
 name-server <FIREWALLDNS-PRIMARY>
 name-server <FIREWALLDNS-SECONDARY>
dhcpd dns <FIREWALLDNS-PRIMARY> <FIREWALLDNS-SECONDARY>
write memory

    Verify it works

    1. Renew DHCP on a client (Windows: ipconfig /renew, macOS: reconnect Wi-Fi).
    2. Run nslookup example.com and check which server answered.
    3. Open the live log in your dashboard. New lookups should appear within seconds.

    Learn more

    Not protected yet?

    FirewallDNS costs $2.90 per device per month.