Black listing websites using FQDN on ASA running 9.6.4

[Richard Bradfield]

There have been problems with Ransom ware sites,

we have list of site IP address that cause problems, so that is easy to add to a black list group

but some locations are only known by their FQDN from certain Domain servers

so we blocked that Domain server as well as the FQDN for the server.

so we note that when the ASA tries to get the IP address,

it talks to our internal DNS,which in turn tries Google, and Telstra which in turn come back with failure for that FQDN

but then it tries the blocked DNS server contunualy because it never gets a response, and the ASA keeps asking

It is doing its job ok the bad sites are blocked.

So my question is there a better way so the ASA does not keep trying?

[Mohammed al Baqari · Accepted solution]

I don't know how you are doing it but if you are using DNS inspection on
ASA it won't try to resolve the domain. For example.

regex domain_logmein.com “\.logmein\.com”
!
class-map type regex match-any DomainBlockList
description Blocked Domains
match regex domain_logmein.com
!
policy-map type inspect dns PM-DNS-inspect
parameters
message-length maximum 512
match domain-name regex class DomainBlockList
drop-connection log
!
policy-map global_policy
class inspection_default
inspect dns PM-DNS-inspect
!
service-policy global_policy global

You also can you ASA botnet with static entries of domains to block the
requests.

[Richard Bradfield]

Mohammed,

Thanks for the response, I will check this out

[Marius Gunnerud]

Is it the ASA itself that is trying to reach the blocked domains or hosts behind the ASA?  

The best option here would be to invest in Umbrella / Open DNS to do URL filtering, or a firewall, such as FTD with FMC, that also supports URL filtering.  That way you do not need to manually update URLs, or IPs in the ASA firewall rules this is done for you.