Cisco ASA: DNS reply filtering
Today I was asked to block access to multiple websites and the only device capable of doing this was the firewall. This customer is using a Cisco ASA firewall, which supports basic URL filtering. This customers wanted to block HTTP and HTTPS websites. HTTPS websites use a SSL tunnel from the end device to the end server, so the firewall isn’t capable of inspecting the SSL traffic. Instead of using URL inspection, I configured DNS inspection.
The ASA inspects the DNS request from the internal DNS server or end device to the external DNS server. I use regular expressions to match the FQDN of a website. Below is an example configuration of blocking access to the website (and applications using a DNS entry to this website) LogMeIn.com
regex domain_logmein.com “\.logmein\.com”
class-map type regex match-any DomainBlockList
description Blocked Domains
match regex domain_logmein.com
policy-map type inspect dns PM-DNS-inspect
message-length maximum 512
match domain-name regex class DomainBlockList
inspect dns PM-DNS-inspect
service-policy global_policy global
A problem with this approach could be the DNS cache on the internal DNS server. This is domain name is queried before configuring the inspection, the domain will be available until the DNS cache from the DNS server expires. In urgent situation you can maybe clear the DNS cache yourself.
If a DNS reply is matched the ASA generates a syslog message, like shown below.
08-28-2009 15:33:31 Local4.Warning 10.10.1.254 %ASA-4-410003: DNS Classification: Dropped DNS request (id 22251) from inside:DNS-SERVER/59256 to outside:UPSTREAM-DNS/53; matched Class 23: match domain-name regex class DomainBlockList
Latest posts by René Jorissen (see all)
- MacOS Big Sur and SSLKEYFILELOG - November 23, 2021
- ClearPass, Azure AD, SSO and Object ID - August 12, 2021
- ClearPass – custom MPSK - July 20, 2021
Hi, could you please explain this command:
class-map type inspect dns match-all BlockDNSClass
?? it’s not use anywhere
The command isn’t used in the configuration and therefore obsolete. I removed it from the configuration.
Some script result failure.
Hands down I’d recommend choosing a cheap ssl certificate. From what I’ve seen, they all function the same, and installation methods are reasonably similar, but the price varies dramatically. Wikipedia has a decent comparison of ssl certificate providers.
I actually blog too and I am crafting a little something
very close to this blog post, “Cisco ASA: DNS request filtering | Booches.
nl”. Do you really mind in the event that Iimplement a lot of of
your own concepts? Thanks for the post ,Jodi
No problem, Jodi. What is the URL of your blog?
congratulation for the great job! I implemented successfully your code, but now I’m trying to do the opposite thing. Allowing only specific domains, and blocking all the others.
I’m trying with the not match command but It still blocks every url.
What is missing?