Cisco ASA Series Cli Configuration Manual page 1113

Chapter 1 Configuring Inspection of Basic Internet Protocols
Command
Step 7
(If you are using a DNS inspection class map)
policy-map type inspect dns name
class class_map_name
{drop [log] | drop-connection [log]|
enforce-tsig {[drop] [log]} | mask [log] |
log}
Example:
hostname(config)# policy-map type inspect
dns dns-map
hostname(config-pmap)# class dns-class-map
hostname(config-pmap-c)# drop
hostname(config-pmap-c)# match header-flag
eq aa
hostname(config-pmap-c)# drop log
Step 8
parameters
{dns-guard | id-mismatch count number
duration seconds action log |
id-randomization | message-length maximum
{length | client {[length] [auto]} |
server {[length] [auto]}} | nat-rewrite |
protocol-enforcement |
tsig enforced action {[drop] [log]}}
Example:
hostname(config-pmap)# parameters
hostname(config-pmap-p)# dns-guard
hostname(config-pmap-p)# id-mismatch
action log
hostname(config-pmap-p)# message-length
maximum 1024
hostname(config-pmap-p)# nat-rewrite
hostname(config-pmap-p)#
protocol-enforcement
Purpose
Creates an inspection policy map, specifies the DNS inspection
class map, and sets the action for the class map:
•
drop [log]—Drops the packet. log also logs the packet.
•
drop-connection [log]—Drops the packet and closes the
connection. log also logs the packet.
•
enforce-tsig {[drop] [log]}—Enforces the TSIG resource
record in a message. drop drops a packet without the TSIG
resource record. log also logs the packet.
•
mask [log]—Masks out the matching portion of the packet.
log also logs the packet.
•
log—Logs the packet.
You can specify multiple class or match commands in the policy
map. For information about the order of class and match
commands, see the "Defining Actions in an Inspection Policy
Map" section on page 2-4.
Enters parameters configuration mode so you can set one or more
parameters:
•
dns-guard—Enables DNS Guard. The ASA tears down the
DNS session associated with a DNS query as soon as the DNS
reply is forwarded by the ASA. The ASA also monitors the
message exchange to ensure that the ID of the DNS reply
matches the ID of the DNS query.
•
id-mismatch count number duration seconds action
log—Enables logging for excessive DNS ID mismatches,
where the count number duration seconds arguments specify
the maximum number of mismatch instances per second
before a system message log is sent.
•
id-randomization—Randomizes the DNS identifier for a
DNS query.
•
message-length maximum {length | client {[length] [auto]}
| server {[length] [auto]}}—Sets the maximum DNS
message length, from 512 to 65535 bytes. You can also set the
maximum length for client or server messages. auto sets the
maximum length to the value in the Resource Record.
•
nat-rewrite—Translates the DNS record based on the NAT
configuration.
•
protocol-enforcement—Enables DNS message format
check, including domain name length of no more than 255
characters, label length of 63 characters, compression, and
looped pointer check.
•
tsig enforced action {[drop] [log]}—Requires a TSIG
resource record to be present. drop drops a non-conforming
packet. log logs the packet.
Cisco ASA Series CLI Configuration Guide
DNS Inspection
1-7