North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: DNS problems to RoadRunner - tcp vs udp

  • From: Justin Shore
  • Date: Fri Jun 13 16:09:04 2008
Justin Shore wrote:
Jon Kibler wrote: 
Various hardening documents for Cisco routers specify the best practices
are to only allow 53/tcp connections to/from secondary name servers.
Plus, from all I can tell, Cisco's 'ip inspect dns' CBAC appears to only
handle UDP data connections and anything TCP would be denied. From what
you are saying, the hardening recommendations are wrong and that CBAC
may break some DNS responses. Is this correct?

A number of Cisco default from years gone by would break DSN, today, in it's current form. Such as how PIXs and ASAs with fixup/DPI would block udp/53 packets larger than 512 bytes, not permitting EDNS packets through.

Thunderbird apparently thought that I was ready to send my message before I did. I was going to add some ASA config as an example.

policy-map type inspect dns migrated_dns_map_1
 parameters
  message-length maximum 2048

I don't have an IOS CBAC example but there's surely something similar.


Justin