Is TCP Inspection is necessary for DNS Inspection ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-06-2017 10:21 PM - edited 02-21-2020 06:27 AM
I have a job to upgrade ASA to customer. (From 8.6 > 9.6..)
I saw in ASA version 9.0.2(and earlier) in section of DNS Inspection command they didn't have "tcp-inspection".
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
But after I upgrade it to 9.6.3 thay have "no tcp-inspection" command show up.
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
This ASA is act like a firewall of server farm(so I think it's may have a DNS Server in INSIDE, that may need to use TCP), Is it should configure "tcp-inspection" on DNS inspect paremeters ?
Before, I had been implement ASA for other site, I saw it have "no tcp-inspection" too, and DNS server of that site is work fine.
PS:: From configuration guide, version 9.6 says in Defaults for DNS Inspection "DNS over TCP inspection is disabled.". But in version 9.0 and 8.6 they didn't say anything.
- Labels:
-
NGFW Firewalls
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-07-2017 01:56 AM - edited 10-07-2017 02:13 AM
Today, DNS should be allowed to run over both UDP and TCP. Many Admins didn‘t adopt this yet, but blocking TCP for DNS is considered a misconfiguration.
If you allow TCP-transport, you should also apply security-measures for DNS for this transport.
What to do:
- If you don‘t allow any outbound TCP/53 for DNS, then you don‘t need tcp-inspection. But you should think about correcting that.
- If you allow TCP-based DNS, then you should think about doing tcp-inspection to apply security also for TCP-transport.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-07-2017 02:45 AM
Thank you for your very clear explanation Karsten.
Can I ask you more for my more clear ?
- If they didn't use TCP for DNS(Actually, I'm not sure), but I have put configure "tcp-inspection", It will impact to the DNS traffic or network security ?
- If they use TCP for DNS(Other site, I had implement), but I did't put "tcp-inspection", It will impact to the DNS traffic or network security ? (I still confure because that site can use DNS server, but I don't know, may be DNS server admin may use other way to communicate with Public DNS? Or they can communicate but did't inspect, cause lacking of security ? )
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-07-2017 03:01 AM
If there is no DNS over TCP, this command should have no effect at all.
If there is is DNS over TCP but it is not configured, then there is no impact of functionality, but limited security for DNS.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-07-2017 03:15 AM
So. For my understanding now.
- It should be/can configure, whether it use TCP or not ?
- After apply "tcp-inspection" for this network (that already use TCP for DNS and work well), after I had upgrade, It will not impact the DNS traffic ?
Am I right in understand?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-07-2017 03:28 AM
After configuring it it will have an impact if there are protocol-anomalies or DNS-based attacks. After implementing it I would take a close look if everything runs right. especially if you run an outdated DNS-resolver. Early implementations of DNS over TCP were not that solid. With up-to-date operating systems there should be no problem with tcp-inspection.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-07-2017 03:42 AM
