Currently Being ModeratedOct 23, 2012 9:50 AM (in response to Ralph Parker)
One gateway box I worked with interpreted the outbound DNS traffic as a UDP storm, and was blocking it. But this is a question best asked of the Cisco folks, as this won't be the first DNS server located behind a Cisco widget, and as OS X Server is running a bog-standard ISC BIND DNS server.
Currently Being ModeratedOct 24, 2012 7:28 PM (in response to MrHoffman)
Thank you for your input. However, I believe I found the problem, which was kind of a convoluted issue, but now seems to be solved.
When I was doing my initial testing with the ASA in place and live, it was assigning ARP tables and remembering the MAC addresses of various Macs and other devices on my LAN, and linking them to DHCP-assigned IP's. Then, I took it out of the Test environment temporarily to do my final offline configuration in preparation to go live. When I put the ASA back in line, in the production environment, with the LAN devices/computered configured for static IP's, I discovered that the ASA DHCP server was assigning IP's that were in conflict with my static-assigned IP's due to MAC and ARP table mismatches. It's just a guess, but I think the NATing was getting confused with where to send the DNS and where to receive the responses.
By clearing the ARP caches and resetting the ASA, it went back to appropriate DHCP assignments (for those few devices that need it) and all is well now.
I realize this may be more info than may be necessary for what may be a unique problem, but I offer it to anyone else who may find themselves in my shoes.