dns question

[techkamleshs]

hi

i was goin through dns doctorig example in the cisco site and was going through packet captures of same . as dns request is udp , is it true that its corresp. dns reply will also come back . As it is UDP packet which is not reliable like TCP , is reply a new session initiated from the destionation ?

[Jennifer Halim]

Yes, the corresponding dns reply should return. It will return the corresponding NAT address according to the static NAT statement that is configured with DNS doctoring.

[techkamleshs]

hi

dns doctorig example was just reference , my ques is more related to networking as dns request is udp i believe it will just deliver the packet to destn , but seeing this eg. as corresp. dns reply is also coming back .i wanted to understnad if reply is a new session initiated from the destination towards source (As it is UDP packet which is not reliable like TCP )

[Jennifer Halim · Accepted solution]

Yes, you are right. UDP is connectionless, and ASA will actually match the ID of the DNS request and reply and makes sure that it matches.

"inspect dns" is required to make sure that it is a legitemate DNS reply that matches the DNS request on the ASA connection table.

Here is more information on dns in specific on ASA for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/i2.html#wp1719130

However, for other UDP packet, you are absolutely right.

[techkamleshs]

thanks ! and matching the ID of the DNS request with reply is done by DNS guard. right ?

[Kureli Sankar]

Kamlesh,

dns guard - ensures one response per request.

You can read here: http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/d2.html#wp1951632

-KS