topic dns inspect on ASA in Network Security

dns inspect on ASA

samuel.olach — Tue, 12 Mar 2019 00:07:51 GMT

I need to remove one host from dns inspection on ASA fw. Currently there is global policy with default inspection :

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

So I created new ACL and match it to new class-map which I included into global policy :

access-list acl_dns_inspect deny ip host x.x.x.x any

access-list acl_dns_inspect permit ip any any

class-map class_dns_inspect

match access-list acl_dns_inspect

policy-map global_policy

class inspection_default

inspect ftp

...

class class_dns_inspect

inspect dns preset_dns_map

Soon after that I realized this was not so good idea when I was not able to reach anything . Probably if I'm not mistaken I have matched all ip traffic and send it for dns inspection which had dropped it all.

I assuming that it should be only tcp/udp port 53. So will the ACL bellow do the same thing as would match default-inspection-traffic do ( without the denied IP af course ) ?

access-list acl_dns_inspect deny tcp host x.x.x.x any eq 53

access-list acl_dns_inspect deny udp host x.x.x.x any eq 53

access-list acl_dns_inspect permit tcp ip any any eq 53

access-list acl_dns_inspect permit tcp any any eq 53

Many thanks

dns inspect on ASA

Harish Balakrishnan — Fri, 12 Oct 2012 07:02:18 GMT

Hello Samuel,

You can do the following . .I am taking the host you do not want to do inspection as 192.168.1.20 in this example

access-list dns line 1 extended deny udp host 192.168.1.20 any eq domain

access-list dns line 2 extended permit udp any any eq domain

class-map dns

match access-list dns

policy-map global_policy

class inspection_default

no inspect dns preset_dns_map

class dns

inspect dns

Verify your configuration in ' sho service-policy inspect dns' where you should not get hit when you are trying from 192.168.1.20

regards

Harish

Please rate if it was helpful!

dns inspect on ASA

samuel.olach — Mon, 22 Oct 2012 09:05:18 GMT

Yes, this worked perfectly.

Thanks