Cisco PIX / ASA and DNSSEC problem approaching on May 5th?

[nifb01food]

So by default all Cisco PIX / ASA configs have something along these lines...

policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1 <-- DNS inspection
...

so after May 5th, when DNSSEC is enabled on all root servers, I'd expect many quereies to be over the 512 byte maximum.  See http://www.theregister.co.uk/2010/04/13/dnssec/ if you are not familiar with this.

Does this mean I should change the 512 number to something else? suggestions on that? or should I just disable DNS inspection completely with: "no inspect dns"

[Panos Kampanakis]

DNSSec will not work with dns inspection (before 8.2.2), so I would suggest disabling it if you use DNSSec.

DNSSec is supported on the ASA after 8.2.2 though.

I hope it helps.

PK

[Przemyslaw Konitz]

pkampana napisano:
DNSSec will not work with dns inspection (before 8.2.2), so I would suggest disabling it if you use DNSSec.
DNSSec is supported on the ASA after 8.2.2 though.
I hope it helps.
PK

Hello,

how DNSSec in 8.2.2 is supported? I've read Realease notes but could not find any clue about it.

Do I still need to increase message-length?

"policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512"

I've seen 8.3 and as I remember there is the same value of DNS max size

regards

P

[ROBERTO TACCON]

Hi Rita,

for example, in earlier versions of PIX (6.3.2 and below), you had to manually configure the DNS fixup to permit DNS packets with the longer length :

fixup protocol dns maximum-length 4096

in more recent versions, it would be covered by :

policy-map type inspect dns preset_dns_map
parameters
message-length maximum 4096

or to increase the response size length:

policy-map global_policy
class inspection_default
inspect dns maximum-length 4096

HTH

http://www.google.com/profiles/roberto.taccon

[dtochilovsky]

Roberto, so even in the newer version of ASA/FWSM code you would need to manually configure the response size length for DNSSEC?

Are there are any announcements from Cisco about what version are affected?

Thank you.

Dmitry.

[ROBERTO TACCON]

please follow:

https://supportforums.cisco.com/message/3056138#3056138

- Are there someone @Cisco that can tell us if the ASA is  aware about the EDNS (from which version) ?

-  Are there someone @Cisco that can tell us if the IOS FIREWALL and IOS  ZONE BASED FIREWALL is aware about the EDNS (from which version) ?

-  or open a TAC case and ask ...

[dtochilovsky]

Thank you Roberto, guess will have to rely on TAC.

Dmitry.

[Panos Kampanakis]

If you use "message-length maximum client auto" under the parameter of the dns map in ASA 8.2.2, if EDNS/DNSSec is used, the command will allow DNS replies up to the length specified in the OPT record, so you will not have any issue.

PK

[dtochilovsky]

Thank you very much. That helps.

[ROBERTO TACCON]

Hi pkampana (CISCO),

the command message-length maximum client auto on the ASA v. 8.2(2) is the default ?

As you can see without using it the EDNS/DNSSec packets still working:

I have the following default config on my ASA version 8.2(2).

policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map netflow-policy
class netflow-export-class
  flow-export event-type all destination ITL01-FMSDEMO
policy-map global_policy
description Netflow
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny 
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip 
  inspect xdmcp

show service-policy inspect dns

Global policy:
  Service-policy: global_policy
    Class-map: inspection_default
      Inspect: dns preset_dns_map, packet 1706599, drop 3746, reset-drop 0
        message-length maximum 512, drop 0
        dns-guard, count 560373
        protocol-enforcement, drop 0
        nat-rewrite, count 0

As can be seen the maximum length is 512 bytes, however if I dig an EDNS server I confirm I get much more than 512 bytes!

From my PC running dig

c:\dig> dig @158.43.128.1 +short rs.dns-oarc.net txt

rst.x3827.rs.dns-oarc.net.

rst.x3837.x3827.rs.dns-oarc.net.

rst.x3843.x3837.x3827.rs.dns-oarc.net.

"62.189.58.236 DNS reply size limit is at least 3843"

"62.189.58.236 sent EDNS buffer size 4096"

"Tested at 2010-04-21 13:44:22 UTC"

So current ASAs you do not need to change the configuration at all, the policy-map is just for DNS not EDNS that DNSSEC uses.

[Panos Kampanakis]

Hmm, yes, that is why in one of my earlier posts I had said that 8.2.2 supports DNSSec and left it to that.

EDNS support goes long back to 7.2 and that command was put there to support EDNS (DNSSec uses it). Without the 'client auto' command DNS traffic will stillpass, but if it is EDNS0 packets AND they are larger than the configured DNSmsg length they should be dropped as any other DNS packet larger than the msglength would be. The client auto command resolves this by looking into the DNSquery which is where the msg size is requested and sets the msg-length "dynamically"to match this request.

We have verified the above through testing.

PK

[smperry]

r.taccon wrote:
As can be seen the maximum length is 512 bytes, however if I dig an EDNS server I confirm I get much more than 512 bytes!
From my PC running dig
c:\dig> dig @158.43.128.1 +short rs.dns-oarc.net txt
rst.x3827.rs.dns-oarc.net.
rst.x3837.x3827.rs.dns-oarc.net.
rst.x3843.x3837.x3827.rs.dns-oarc.net.
"62.189.58.236 DNS reply size limit is at least 3843"
"62.189.58.236 sent EDNS buffer size 4096"
"Tested at 2010-04-21 13:44:22 UTC"
So current ASAs you do not need to change the configuration at all, the policy-map is just for DNS not EDNS that DNSSEC uses.

That packet on the wire is is actually smaller than 512 bytes, that's why it passes.

You still need to apply ASA 8.2.2 and the "message-length maximum client auto" parameter.

I applied the above to my ASA5510 this morning and immediately all dns queries are working properly again and there are no more syslogs for exeeding 512 bytes.  See attached pcap for details of now working query.

[Jennifer Halim]

Here is the bugID for DNSSEC :CSCta35563:

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCta35563

It does include the version of code that has the fix.

[tcording]

Hi Jen

Do we still need to change the message-length maximum 512 to message-length maximum client auto?

The bugID would seem to suggest that it still needs to changed

Troy

[Panos Kampanakis]

You don't need to change them. You can have them both there

policy-map type inspect dns preset_dns_map  parameters

  message-length maximum client auto

  message-length maximum 512

This configuration essentially provides the most optimal solution in that it behaves according to RFC/spec and using the 'message-length maximum client auto' line allows the ASA to look into the DNSSEC query packets and set the size accordingly for the subsequent DNSSEC traffic to pass. Note you use both the 'client auto' and the '512' command in tandem as if a non DNSSEC (EDNS0) packet is being processed it will be processed according to the standard or defacto message-length command.

I hope it helps.

PK