<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Jul 25, 2010, at 3:34 PM, Kevin Oberman wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div><blockquote type="cite">From: Warren Kumari <<a href="mailto:warren@kumari.net">warren@kumari.net</a>><br></blockquote><blockquote type="cite">Date: Sun, 25 Jul 2010 11:22:46 +0200<br></blockquote><blockquote type="cite">Sender: <a href="mailto:bind-users-bounces+oberman=es.net@lists.isc.org">bind-users-bounces+oberman=es.net@lists.isc.org</a><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">On Jul 25, 2010, at 4:33 AM, Danny Mayer wrote:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><blockquote type="cite">On 7/24/2010 5:10 AM, Warren Kumari wrote:<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">On Jul 23, 2010, at 2:37 PM, Danny Mayer wrote:<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">On 7/22/2010 11:08 PM, Merton Campbell Crockett wrote:<br></blockquote></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">Thanks for the confirmation that the problem was related to DNSSEC.<br></blockquote></blockquote></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">I didn't see your message until I got home from work; however, I did<br></blockquote></blockquote></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">find the root of the problem late this afternoon. At each of our<br></blockquote></blockquote></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">Internet egress and ingress points, we have Cisco ASA devices sitting in<br></blockquote></blockquote></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">front of a pair of redundant firewalls. Each ASA is configured with the<br></blockquote></blockquote></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">default DNS inspect policy that doesn't accept fragmented UDP packets.<br></blockquote></blockquote></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">Why would any inspection policy not allow fragmented UDP packets?<br></blockquote></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">There's nothing wrong with that.<br></blockquote></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">Because it's "hard".... The issue is that then you need to buffer<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">fragments until you get a full packet -- which leaves you open to<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">attacks that send a bunch of fragments but leave one of them out.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">Vendors like to avoid reassembling fragments by default, because it<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">makes their performance numbers better....<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">At the expense of correct behavior and loss of real performance.<br></blockquote></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Yes. <br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Sorry, if I gave the impression that I was condoning this -- I'm not.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Vendors exist to sell boxen -- tuning for the test cases at the<br></blockquote><blockquote type="cite">expense of correctness often wins....<br></blockquote><br>And, as tests start to include DNSSEC (and EDNS0) tests, the vendors will<br>likely adjust defaults. Tests for DNSSEC are already appearing on<br>federal systems (not a trivial part of the business) and will likely<br>become general test in the procurement process in the next year. <br><br>Of course, changing defaults will take longer to change.<br><br>Now to a more basic question...why the ^@#$ does everyone put STATEFUL<br>firewalls in front of servers. They are a denial of service attack<br>waiting to happen. I don't know of any highly regarded security expert<br>who recommends them and most object to them rather strongly.<br><br>I will admit to once having stateful firewalls in front of my DNS<br>servers, but after an unfortunate case of a badly written application<br>DOSing ourselves, stateful firewalls have been removed. Yes, the software<br>needed fixing, but the software was not enough to cause any problem for<br>the servers...just the firewall. And, yes, we still have stateless<br>firewalls in front of our DNS servers and other public servers as well<br>as an aggressive IDS/IPS system.<br></div></blockquote><div><br></div><div>Here! Here! I much prefer using "packet filter" firewalls at the outer markers but haven't been able to sway security or my network colleagues.</div><div><br></div><div>For those interested, the error code is ASA-4-209005. The error is that the message contains more than 1 element. So far the first "fix" didn't solve the problem and I haven't seen what problems that the next layer of firewalls will produce.</div><div><br></div></div><br><div>
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span class="Apple-style-span" style="border-collapse: separate; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; color: rgb(0, 0, 0); font-family: 'Helvetica Neue'; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; -webkit-text-decorations-in-effect: none; text-indent: 0px; -webkit-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; color: rgb(0, 0, 0); font-family: 'Helvetica Neue'; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; -webkit-text-decorations-in-effect: none; text-indent: 0px; -webkit-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><div>--</div><div>Merton Campbell Crockett</div><div><a href="mailto:m.c.crockett@roadrunner.com">m.c.crockett@roadrunner.com</a></div><div><br class="khtml-block-placeholder"></div><br class="Apple-interchange-newline"></span></div></span></span><br class="Apple-interchange-newline">
</div>
<br></body></html>