Re: Is TCP Inspection is necessary for DNS Inspection ?

Jiramate.Petcharat · ‎10-06-2017

I have a job to upgrade ASA to customer. (From 8.6 > 9.6..)

I saw in ASA version 9.0.2(and earlier) in section of DNS Inspection command they didn't have "tcp-inspection".

policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512

But after I upgrade it to 9.6.3 thay have "no tcp-inspection" command show up.

policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection

This ASA is act like a firewall of server farm(so I think it's may have a DNS Server in INSIDE, that may need to use TCP), Is it should configure "tcp-inspection" on DNS inspect paremeters ?

Before, I had been implement ASA for other site, I saw it have "no tcp-inspection" too, and DNS server of that site is work fine.

PS:: From configuration guide, version 9.6 says in Defaults for DNS Inspection "DNS over TCP inspection is disabled.". But in version 9.0 and 8.6 they didn't say anything.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/firewall/asa-96-firewall-config/inspect-basic.html#ID-2092-00000007

https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/inspect_basic.html#10154

https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/inspect_basic.html#wp1335632

Karsten Iwen · ‎10-07-2017

Today, DNS should be allowed to run over both UDP and TCP. Many Admins didn‘t adopt this yet, but blocking TCP for DNS is considered a misconfiguration.

If you allow TCP-transport, you should also apply security-measures for DNS for this transport.

What to do:

If you don‘t allow any outbound TCP/53 for DNS, then you don‘t need tcp-inspection. But you should think about correcting that.
If you allow TCP-based DNS, then you should think about doing tcp-inspection to apply security also for TCP-transport.

Jiramate.Petcharat · ‎10-07-2017

Thank you for your very clear explanation Karsten.

Can I ask you more for my more clear ?

If they didn't use TCP for DNS(Actually, I'm not sure), but I have put configure "tcp-inspection", It will impact to the DNS traffic or network security ?
If they use TCP for DNS(Other site, I had implement), but I did't put "tcp-inspection", It will impact to the DNS traffic or network security ? (I still confure because that site can use DNS server, but I don't know, may be DNS server admin may use other way to communicate with Public DNS? Or they can communicate but did't inspect, cause lacking of security ? )

Karsten Iwen · ‎10-07-2017

If there is no DNS over TCP, this command should have no effect at all.

If there is is DNS over TCP but it is not configured, then there is no impact of functionality, but limited security for DNS.

Jiramate.Petcharat · ‎10-07-2017

So. For my understanding now.

It should be/can configure, whether it use TCP or not ?
After apply "tcp-inspection" for this network (that already use TCP for DNS and work well), after I had upgrade, It will not impact the DNS traffic ?

Am I right in understand?

Karsten Iwen · ‎10-07-2017

After configuring it it will have an impact if there are protocol-anomalies or DNS-based attacks. After implementing it I would take a close look if everything runs right. especially if you run an outdated DNS-resolver. Early implementations of DNS over TCP were not that solid. With up-to-date operating systems there should be no problem with tcp-inspection.

Jiramate.Petcharat · ‎10-07-2017

Very very clear. Thank you so much Karsten :)