topic Re: Is TCP Inspection is necessary for DNS Inspection ? in Network Security

Is TCP Inspection is necessary for DNS Inspection ?

Jiramate.Petcharat — Fri, 21 Feb 2020 14:27:07 GMT

I have a job to upgrade ASA to customer. (From 8.6 > 9.6..)

I saw in ASA version 9.0.2(and earlier) in section of DNS Inspection command they didn't have "tcp-inspection".

policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512

But after I upgrade it to 9.6.3 thay have "no tcp-inspection" command show up.

policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection

This ASA is act like a firewall of server farm(so I think it's may have a DNS Server in INSIDE, that may need to use TCP), Is it should configure "tcp-inspection" on DNS inspect paremeters ?

Before, I had been implement ASA for other site, I saw it have "no tcp-inspection" too, and DNS server of that site is work fine.

PS:: From configuration guide, version 9.6 says in Defaults for DNS Inspection "DNS over TCP inspection is disabled.". But in version 9.0 and 8.6 they didn't say anything.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/firewall/asa-96-firewall-config/inspect-basic.html#ID-2092-00000007

https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/inspect_basic.html#10154

https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/inspect_basic.html#wp1335632

Re: Is TCP Inspection is necessary for DNS Inspection ?

Karsten Iwen — Sat, 07 Oct 2017 09:13:21 GMT

Today, DNS should be allowed to run over both UDP and TCP. Many Admins didn‘t adopt this yet, but blocking TCP for DNS is considered a misconfiguration.

If you allow TCP-transport, you should also apply security-measures for DNS for this transport.

What to do:

If you don‘t allow any outbound TCP/53 for DNS, then you don‘t need tcp-inspection. But you should think about correcting that.
If you allow TCP-based DNS, then you should think about doing tcp-inspection to apply security also for TCP-transport.

Re: Is TCP Inspection is necessary for DNS Inspection ?

Jiramate.Petcharat — Sat, 07 Oct 2017 09:45:27 GMT

Thank you for your very clear explanation Karsten.

Can I ask you more for my more clear ?

If they didn't use TCP for DNS(Actually, I'm not sure), but I have put configure "tcp-inspection", It will impact to the DNS traffic or network security ?
If they use TCP for DNS(Other site, I had implement), but I did't put "tcp-inspection", It will impact to the DNS traffic or network security ? (I still confure because that site can use DNS server, but I don't know, may be DNS server admin may use other way to communicate with Public DNS? Or they can communicate but did't inspect, cause lacking of security ? )

Re: Is TCP Inspection is necessary for DNS Inspection ?

Karsten Iwen — Sat, 07 Oct 2017 10:01:15 GMT

If there is no DNS over TCP, this command should have no effect at all.

If there is is DNS over TCP but it is not configured, then there is no impact of functionality, but limited security for DNS.

Re: Is TCP Inspection is necessary for DNS Inspection ?

Jiramate.Petcharat — Sat, 07 Oct 2017 10:15:33 GMT

So. For my understanding now.

It should be/can configure, whether it use TCP or not ?
After apply "tcp-inspection" for this network (that already use TCP for DNS and work well), after I had upgrade, It will not impact the DNS traffic ?

Am I right in understand?

Re: Is TCP Inspection is necessary for DNS Inspection ?

Karsten Iwen — Sat, 07 Oct 2017 10:28:51 GMT

After configuring it it will have an impact if there are protocol-anomalies or DNS-based attacks. After implementing it I would take a close look if everything runs right. especially if you run an outdated DNS-resolver. Early implementations of DNS over TCP were not that solid. With up-to-date operating systems there should be no problem with tcp-inspection.

Re: Is TCP Inspection is necessary for DNS Inspection ?

Jiramate.Petcharat — Sat, 07 Oct 2017 10:42:59 GMT

Very very clear. Thank you so much Karsten 🙂