topic Re: DNS response traffic getting dropped in Network Security

DNS response traffic getting dropped

Colin Higgins — Tue, 12 Mar 2019 00:29:42 GMT

We have a FWSM running 3.2 IOS in a cat 6509

Clients and server conducting queries against MS 2003 AD servers running DNS are having problems, and in the syslog I see messages like

Deny inbound UDP from 172.25.59.106/53 to 172.25.55.11/56465 due to DNS Response

UDP 53 is allowed from the subnets into the subnets/vlans where the DNS servers reside, and

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

has been enabled (the vlans have the same security level).

I have also attempted to turn off DNS inspection in the global policy (no inspect dns)

Nevertheless, these errors persist. Anyone have any ideas?

Re: DNS response traffic getting dropped

ju_mobile — Wed, 28 Nov 2012 21:56:34 GMT

Please add
inspect dns maximum-length 1024

To your configuration. If you read the DNS RFC as with TFTP the packets should not exceed 512 bytes.
As such the FWSM/ASA has a default DNS size of 512 bytes

Best Regards

Ju

Sent from Cisco Technical Support iPad App

Re: DNS response traffic getting dropped

Julio Carvajal — Thu, 29 Nov 2012 01:31:20 GMT

Hello Colin,

What are the DNS servers being used by your local area network clients?

How many are there?

Regards,

Julio

Re: DNS response traffic getting dropped

david.tran — Thu, 29 Nov 2012 12:51:14 GMT

why are you telling him in increase the dns length to 1024? When he turns OFF dns inpsect (aka no fixup protol 53 dns), should that turns off inspecting DNS altogether?

Re: DNS response traffic getting dropped

ju_mobile — Thu, 29 Nov 2012 13:05:36 GMT

David,

The RFC states and Cisco obliges that DNS responses should be less than 512Bytes. The Firewall will drop any DNS response over 512bytes, unles sthe size is increased. The changes to DNS for DNSSEC means that the 512byte limit is often exceeded.

http://www.cisco.com/web/about/security/intelligence/dnssec.html

Obviously, turning inspect off would negate the need for this command. Based on me missing that part of his post altogether. In which case its probably worth disabling DNS-GUARD..

Regards

Re: DNS response traffic getting dropped

david.tran — Thu, 29 Nov 2012 13:13:50 GMT

I don't work with ASA on daily basis (checkpoint is what I am doing these days); however, I thought can disable dns-guard if you have inspect DNS enable.

My understand of this is that once you turn OFF inspect DNS, dns-guard is also disabled as well because dns-guard is a subset of inspect DNS

Re: DNS response traffic getting dropped

ju_mobile — Thu, 29 Nov 2012 13:24:38 GMT

David,

As i'm sure your aware, I believe there are some variations between the ASA/PIX/FWSM. As i understand it teh question raised was in reference to teh FWSM 3.2 which has its own features or whatever semantics you wish to use.

http://www.cisco.com/web/about/security/intelligence/dns-bcp.html

search for DNS-GUARD

Best Regards

Ju (stuff is what I do these days)

Re: DNS response traffic getting dropped

Colin Higgins — Thu, 29 Nov 2012 14:11:13 GMT

jcarvaja:

we have two DNS servers in the environment, both on the same subnet, which is a firewalled VLAN on the FWSM.

I am seeing these DNS errors on reply traffic from those servers to other VLANs/subnets on the same FWSM

It appears as though this "dns guard" feature cannot be turned off yes?

Re: DNS response traffic getting dropped

ju_mobile — Thu, 29 Nov 2012 14:20:17 GMT

DNS-Guard can be disabled. On the ASDM go to device management, advanced, DNS and from in that location untick the DnS-guard box

Best Regards

Ju

Sent from Cisco Technical Support iPhone App

Re: DNS response traffic getting dropped

david.tran — Thu, 29 Nov 2012 15:09:53 GMT

that's goes back to my original thought. Once you disable inspecting DNS "no fixup protocol 53 dns", shouldn't that turn OFF dns-guard as well?

Re: DNS response traffic getting dropped

ju_mobile — Thu, 29 Nov 2012 16:20:31 GMT

Yes,

But not on a FWSM running a 3.2 code.

Regards

Ju

Sent from Cisco Technical Support iPhone App

Re: DNS response traffic getting dropped

Julio Carvajal — Thu, 29 Nov 2012 16:49:15 GMT

Hello Colin,

Exactly,

This is because of the DNS guard feature.. One of your local DNS servers is replying later than the other DNS so as the ASA already received a DNS reply from one DNS server the other one will be dropped.

So this message can be safely ignored

Let me know if you do understand what I mean

Julio