<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:$B^b%4%7%C%/(B;
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"$B#M#S(B $B#P%4%7%C%/(B";
panose-1:2 11 6 0 7 2 5 8 2 4;}
@font-face
{font-family:"\@$B#M#S(B $B#P%4%7%C%/(B";}
@font-face
{font-family:"\@$B^b%4%7%C%/(B";
panose-1:2 11 4 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0mm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"$B#M#S(B $B#P%4%7%C%/(B";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.17
{mso-style-type:personal-compose;
font-family:$B^b%4%7%C%/(B;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:$B^b%4%7%C%/(B;}
/* Page Definitions */
@page WordSection1
{size:612.0pt 792.0pt;
margin:99.25pt 30.0mm 30.0mm 30.0mm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026">
<v:textbox inset="5.85pt,.7pt,5.85pt,.7pt" />
</o:shapedefaults></xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="JA" link="#0563C1" vlink="#954F72" style="text-justify-trim:punctuation">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B">Hi Max<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B">ALG seems to be managing sessions.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B">Specifically, if the DNS query packet is the first packet<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B">After creating a session and receiving a DNS responce packet<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B">The session seems to be closed with ALG.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B">It is thought that attention is needed when ALG is disable.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B">If ALG is disable, the session will be maintained until UDP timeout (1 minute).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B">I do not have any further information. If detailed information is necessary, I recommend that you contact Juniper support.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B">--<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B">Yoshibumi Suematsu<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B">QTnet, Inc.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> bind-users [<a href="mailto:bind-users-bounces@lists.isc.org">mailto:bind-users-bounces@lists.isc.org</a>]
<b>On Behalf Of </b><a href="mailto:nmaxpierson@gmail.com">nmaxpierson@gmail.com</a><br>
<b>Sent:</b> Sunday, January 20, 2019 2:46 AM<br>
<b>To:</b> Crist Clark <<a href="mailto:cjc+bind-users@pumpky.net">cjc+bind-users@pumpky.net</a>><br>
<b>Cc:</b> <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
<b>Subject:</b> [</span><span style="font-size:11.0pt">$B<R30$+$i<u?.(B</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">](</span><span style="font-size:11.0pt">$BAw?.<T3NG'(B</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">)Re:
EDNS Compliance<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I just reconfigured our SRX and everything seems to be working now. I wasn</span>$B!G(B<span lang="EN-US">t aware that some alg</span>$B!G(B<span lang="EN-US">s were enabled by default so thank you for pointing that out.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Max<br>
--<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Sent via mobile<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US"><br>
On Jan 18, 2019, at 9:22 PM, Crist Clark <<a href="mailto:cjc+bind-users@pumpky.net">cjc+bind-users@pumpky.net</a>> wrote:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">In SRX speak:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> # set security alg dns disable<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">To verify status of DNS and other ALGs:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> show security alg status<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The DNS ALG is one of those enabled by default and must be explicitly disabled to turn it off.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">On Fri, Jan 18, 2019 at 1:14 PM N. Max Pierson <<a href="mailto:nmaxpierson@gmail.com">nmaxpierson@gmail.com</a>> wrote:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The 2 servers that pass the check are behind an old Cisco FWSM so I know it at least works. Hopefully that code carried over to the ASA and won't give us any problems but if it does, I have the option of moving these
servers directly to the internet and I can configure iptables for any filtering we need.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">As far as any option in the SRX, I do not see any configuration options to disable the version check for EDNS as you suggested. I have a couple of posts on Juniper forms/mailing lists to see if I get anyone familiar with
these options but for the moment we are just using the SRX as a packet filter with no ALGs so we may be out of luck.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Max<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Max<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">On Fri, Jan 18, 2019 at 3:07 PM Mark Andrews <<a href="mailto:marka@isc.org" target="_blank">marka@isc.org</a>> wrote:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I can</span>$B!G(B<span lang="EN-US">t remember if Cisco ASA has a similar issue. Checkpoint does have similar<br>
issues (EDNS version != 0 and EDNS flags) last time I checked. Checkpoint were<br>
thinking of changing the defaults. You just need to turn off the setting on the<br>
Juniper. It really shouldn</span>$B!G(B<span lang="EN-US">t be on by default as it doesn</span>$B!G(B<span lang="EN-US">t do anything useful.<br>
<br>
> On 19 Jan 2019, at 7:52 am, N. Max Pierson <<a href="mailto:nmaxpierson@gmail.com" target="_blank">nmaxpierson@gmail.com</a>> wrote:<br>
> <br>
> I was just trying to figure out how I could log this but since the logging would only probably show if something didn't match udp 53 on the server IP it probably wouldn't match the block-any catch-all log I configured. I will certainly bring this up to our
Juniper rep but in the meantime, I have a spare Cisco ASA I am going to migrate these subnets to and see if that fixes the timeouts we are experiencing.<br>
> <br>
> Mark, thank you for your explanation. And if anyone knows someone at Juniper you may want to mention this to them as if they do not fix it before flag day, a lot of queries will be broken.<br>
> <br>
> Regards,<br>
> Max<br>
> <br>
> On Fri, Jan 18, 2019 at 2:42 PM Mark Andrews <<a href="mailto:marka@isc.org" target="_blank">marka@isc.org</a>> wrote:<br>
> This is the signature of a Juniper firewall which drops EDNS version != 0 and<br>
> packet with a NSID option present. Dropping EDNS version != 0 just breaks<br>
> future interoperability and as already impacted of EDNS development as the<br>
> RFC 6891 would have included a EDNS version bump except for these stupid<br>
> firewalls dropping EDNS version != 0. NSID is used to identify a server<br>
> in a anycast cluster and the information is not returned unless the operator<br>
> has configured the server to return it. There is no need for a firewall to<br>
> drop queries with these properties.<br>
> <br>
> Please file a bug report with Juniper.<br>
> <br>
> Mark</span><span lang="EN-US" style="font-size:11.0pt;font-family:$B^b%4%7%C%/(B"><o:p></o:p></span></p>
</div>
</body>
</html>