Re: Help

["Utz, Ralph" <rutz () realtime-it com>]

I haven't run your test, but I have delt with this problem on a
consulting basis in the past.  Here's some info: PIX 6.3.5 and below
block any DNS packet larger than 512 by default.  When EDNS forces a
packet larger than 512 the firewall will drop the packet.  In Windows
installations I've seen this cause the DNS service to hang and stop
responding to requests.  The PIX can be configured to allow larger DNS
packets.  

-----Original Message-----
From: firewall-wizards-bounces () listserv icsalabs com
[mailto:firewall-wizards-bounces () listserv icsalabs com] On Behalf Of
Dave Piscitello
Sent: Wednesday, November 15, 2006 6:26 AM
To: Firewall Wizards Security Mailing List
Subject: [fw-wiz] Help

Can I ask some of you who live behind commercial firewalls to do the 
following DNS dig for a small study I would like to conduct?

dig hk ns +bufsize=4096 @203.119.2.18 > <file>

If you could tell me the OS you used to dig, the firewall between your 
resolver and the name server and if you know, the firewall SW version, 
you'd really make my day. BTW, if you don't get an answer, that is a 
very useful data point.

I am trying to gather some anecdotal evidence regarding how firewalls 
deal with EDNS0 responses (esp. DNS messages > 512) and AAAA records.

I have results for
Netscreen (ScreenOS V5.30r3, 4.0.3r4.0)
Sonicwall (SonicOS Standard 3.1.0.7-77s)
Cisco PIX version 7.2.1
Cisco C2600 IOS 12.2(37)
Watchguard FBX1000 (Fireware v8.2)

I could really use some data from current and previous versions of 
Checkpoint, Symantec, Sidewinder, Fortinet to help fill out the "market 
share tested" pie chart.




The information in this email and in any attachments is confidential and may be privileged. 
If you are not the intended recipient, please destroy this message, delete any copies held 
on your systems and notify the sender immediately. You should not retain, copy, or use this 
email for any purpose, and any review or other use of this information by persons or 
entities other than the intended recipient or any retransmission without the written consent 
of the sender is expressly prohibited.
_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards