topic Re: dns question in Network Security

dns question

techkamleshs — Mon, 11 Mar 2019 19:29:15 GMT

i was goin through dns doctorig example in the cisco site and was going through packet captures of same . as dns request is udp , is it true that its corresp. dns reply will also come back . As it is UDP packet which is not reliable like TCP , is reply a new session initiated from the destionation ?

Re: dns question

Jennifer Halim — Fri, 31 Dec 2010 12:28:32 GMT

Yes, the corresponding dns reply should return. It will return the corresponding NAT address according to the static NAT statement that is configured with DNS doctoring.

Re: dns question

techkamleshs — Fri, 31 Dec 2010 12:45:15 GMT

dns doctorig example was just reference , my ques is more related to networking as dns request is udp i believe it will just deliver the packet to destn , but seeing this eg. as corresp. dns reply is also coming back .i wanted to understnad if reply is a new session initiated from the destination towards source (As it is UDP packet which is not reliable like TCP )

Re: dns question

Jennifer Halim — Fri, 31 Dec 2010 13:25:06 GMT

Yes, you are right. UDP is connectionless, and ASA will actually match the ID of the DNS request and reply and makes sure that it matches.

"inspect dns" is required to make sure that it is a legitemate DNS reply that matches the DNS request on the ASA connection table.

Here is more information on dns in specific on ASA for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/i2.html#wp1719130

However, for other UDP packet, you are absolutely right.

Re: dns question

techkamleshs — Fri, 31 Dec 2010 14:09:11 GMT

thanks ! and matching the ID of the DNS request with reply is done by DNS guard. right ?

Re: dns question

Kureli Sankar — Fri, 31 Dec 2010 14:30:46 GMT

Kamlesh,

dns guard - ensures one response per request.

You can read here: http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/d2.html#wp1951632

-KS