topic ASA issue, DNS error messages getting logged in Network Security

ASA issue, DNS error messages getting logged

carl_townshend — Tue, 12 Mar 2019 02:15:23 GMT

Hi all

I seem to have an issue with something on my ASA

Im getting logs showing the following

Jul 22 2013

16:48:32

410001

x.x.x.x

1026

x.x.x.x

Dropped UDP DNS request from Test-link:x.x.x.x/1026 to Outside:x.x.x.x/53; label length 84 bytes exceeds protocol limit of 63 bytes

Any ideas what this is and how I can solve it, I have checked my DNS inspection and the global limit it 1500 at the moment so dont know where to look

cheers

Re: ASA issue, DNS error messages getting logged

Julio Carvajal — Mon, 22 Jul 2013 16:21:01 GMT

Hello,

Basically the DNS request contains a host name of which the label is longer than 63 characters. A "label" is any component between dots in a host name.

In the case of the ASA, the DNS enforcement reads the domain name one label at a time. According to RFC 1034, a label is zero to 63 octets in length.

So the ASA behavior is the expected one,

You cannot tune the DNS inspection to increase the label size, so if you are 100 % sure this is valid traffic you could (NOT recommended) disable the DNS protocol-enforcement which will basically ignore what the RFC says (Again not recommended)

For Networking Posts check my blog at http://www.laguiadelnetworking.com/category/english/

Cheers,

Julio Carvajal Segura

Re: ASA issue, DNS error messages getting logged

carl_townshend — Mon, 22 Jul 2013 21:07:51 GMT

How do I resolve this issue ?

Re: ASA issue, DNS error messages getting logged

Julio Carvajal — Mon, 22 Jul 2013 21:49:14 GMT

Hello Carl,

Well that depends:

-Do you want to get rid of those logs?

-Do you want to maintain the network as secure as possible?

Those are the questions you need to ask and the answers will be:

-Disable the protocol enforcement for the DNS protocol

-Keep the configuration the way it is and investigate the DNS query being created by the user on TestLink interface, make sure is a valid one and is not an attack

For Networking Posts check my blog at http://www.laguiadelnetworking.com/category/english/

Cheers,

Julio Carvajal Segura