Re: Help

[Aaron Smith <smitha () byui edu>]

On Wed, 2006-11-15 at 08:26 -0600, Utz, Ralph wrote:
> I haven't run your test, but I have delt with this problem on a
> consulting basis in the past.  Here's some info: PIX 6.3.5 and below
> block any DNS packet larger than 512 by default.  When EDNS forces a
> packet larger than 512 the firewall will drop the packet.  In Windows
> installations I've seen this cause the DNS service to hang and stop
> responding to requests.  The PIX can be configured to allow larger DNS
> packets.  

And, conversely, Windows EDNS0 can be disabled, as we did in our
environment.

@@ron Smith
_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards