Is TCP Inspection is necessary for DNS Inspection ?

[Jiramate.Petcharat]

I have a job to upgrade ASA to customer. (From 8.6 > 9.6..)

I saw in ASA version 9.0.2(and earlier) in section of DNS Inspection command they didn't have "tcp-inspection".

policy-map type inspect dns preset_dns_map
  parameters
    message-length maximum client auto
    message-length maximum 512

But after I upgrade it to 9.6.3 thay have  "no tcp-inspection" command show up.

policy-map type inspect dns preset_dns_map
  parameters
    message-length maximum client auto
    message-length maximum 512
    no tcp-inspection

This ASA is act like a firewall of server farm(so I think it's may have a DNS Server in INSIDE, that may need to use TCP), Is it should configure "tcp-inspection" on DNS inspect paremeters ?

Before, I had been implement ASA for other site, I saw it have "no tcp-inspection" too, and DNS server of that site is work fine.

PS:: From configuration guide, version 9.6 says in Defaults for DNS Inspection "DNS over TCP inspection is disabled.". But in version 9.0 and 8.6 they didn't say anything.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/firewall/asa-96-firewall-config/inspect-basic.html#ID-2092-00000007

https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/inspect_basic.html#10154

https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/inspect_basic.html#wp1335632

[Karsten Iwen]

Today, DNS should be allowed to run over both UDP and TCP. Many Admins didn‘t adopt this yet, but blocking TCP for DNS is considered a misconfiguration.

If you allow TCP-transport, you should also apply security-measures for DNS for this transport.

What to do:

• If you don‘t allow any outbound TCP/53 for DNS, then you don‘t need tcp-inspection. But you should think about correcting that.
• If you allow TCP-based DNS, then you should think about doing tcp-inspection to apply security also for TCP-transport.

[Jiramate.Petcharat]

Thank you for your very clear explanation Karsten.

Can I ask you more for my more clear ?

• If they didn't use TCP for DNS(Actually, I'm not sure), but I have put configure "tcp-inspection", It will impact to the DNS traffic or network security ?
• If they use TCP for DNS(Other site, I had implement), but I did't put "tcp-inspection", It will impact to the DNS traffic or network security ?  (I still confure because that site can use DNS server, but I don't know, may be DNS server admin may use other way to communicate with Public DNS? Or they can communicate but did't inspect, cause lacking of security ? )

[Karsten Iwen]

If there is no DNS over TCP, this command should have no effect at all.

If there is is DNS over TCP but it is not configured, then there is no impact of functionality, but limited security for DNS.

[Jiramate.Petcharat]

So. For my understanding now.

• It should be/can configure, whether it use TCP or not ?
• After apply "tcp-inspection" for this network (that already use TCP for DNS and work well), after I had upgrade, It will not impact the DNS traffic ?

Am I right in understand?

[Karsten Iwen]

After configuring it it will have an impact if there are protocol-anomalies or DNS-based attacks. After implementing it I would take a close look if everything runs right. especially if you run an outdated DNS-resolver. Early implementations of DNS over TCP were not that solid. With up-to-date operating systems there should be no problem with tcp-inspection.

[Jiramate.Petcharat]

Very very clear. Thank you so much Karsten :)