Sinkholing server regarding ASA firepower services

[crux_jha1]

I run ASA with firepower services at multiple clients and have been wordeing about the new DNS sinkholing feature. My main goal would be to get insight on what IPs are generating the DNS querys for bad domains (right now i only see the internal recursive DNS server as the source). Does the Sinkhole IP has to be a server that actually respond to querys or can i just use a unused IP in my public IP range?

BR

Josef

[ankojha]

Hi Josef,

For sinkholing , you can have unused ip in any public range as we are basically detecting bad DNS queries in the first place without waiting for actual response.

Rate if it helps.

Thanks,

Ankita

[crux_jha1]

Thanks!

Do FMC report on what clients try to communicate with the sinkhole IP besides in the connection events? Will there be a SI/Malware/IPS event generated?

BR

Josef

[ChiefSec-SF]

Have you made any progress on this? I also set this up within Sourcefire but the Sinkhole IP address is only returned for direct queries and recursive queries return just a server failed message. If you have found a resolution, please post. Thanks.

[crux_jha1]

I havn't had the time to set this up, so no.

[SHABEEB KUNHIPOCKER]

Hello,

Did you find any solution for this issue?. I have the same problem.

Thanks

Shabeeb

[ChiefSec-SF]

There is a documented bug:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvb99851/?reffering_site=dumpcr

Apparently the use of DNS extensions breaks the Sinkhole feature. 

Link on how to disable the extensions for MS DNS servers:

https://support.microsoft.com/en-us/help/832223/some-dns-name-queries-are-unsuccessful-after-you-deploy-a-windows-based-dns-server

(Applies to Server 2008 and above)

After disabling this the Sinkholing feature started working correctly by responding to the recursive queries from our internal DCs. However the SI events still only show the DC as the source of the query. You will need to look in connection events for the attempted network connections to the Sinkhole IP in order to identify the actual source of the original query. Hope that helps.