Displaying Dns Attack Protection Information - Brocade Communications Systems ServerIron ADX 12.4.00a Security Manual

Version 12.4.00a

Table of Contents

DNS attack protection

This command enables DNS content switching.

Configuring global commands for DNS attack protection

You can optionally configure the following to apply to all DNS attack protection configurations:

•

To configure a ServerIron ADX to drop all DNS packets that are fragmented, use the server dns-dpi

drop-frag-pkts command as shown.

ServerIron(config) server dns-dpi drop-frag-pkts

Syntax: [no] server dns-dpi drop-frag-pkts

To configure a ServerIron ADX to drop all DNS packets with multiple queries, use the server dns-dpi

drop-multiple-query-pkts command as shown.

ServerIron(config) server dns-dpi drop-multiple-query-pkts

Syntax: [no] server dns-dpi drop-multiple-query-pkts

To configure a ServerIron ADX to drop all DNS packets that are malformed, use the server dns-dpi

drop-incomplete-malformed-pkts command as shown.

ServerIron(config) server dns-dpi drop-incomplete-malformed-pkts

Syntax: [no] server dns-dpi drop-incomplete-malformed-pkts

Configuring the ADX to drop requests if servers in redirect actions are down

You can configure the ServerIron ADX to drop requests if servers in redirect actions are down as

shown.

ServerIron(config-csw-pol-p1) dns-drop-on-fwd-fail

Syntax: [no] dns-drop-on-fwd-fail

Configuring the ADX to evaluate rules without query name first

You can configure the ServerIron ADX to evaluate rules without query name first as shown.

ServerIron(config-csw-pol-p1) evaluate-generic-first

Syntax: [no] evaluate-generic-first