topic Re: DNS bad TCP in Firewall and Security Management

DNS bad TCP

handiansudianto — Tue, 25 Jul 2023 12:11:44 GMT

Hello,

We pointing DNS IP address for our VPN Pool IP to internal windows DNS server. When i check log on the windows dns server i got many warning 'The DNS server received a bad TCP-based DNS message from 10.103.254.6. The packet was rejected or ignored. The event data contains the DNS packet.'

IP 10.103.254.6 is our checkpoint.

Re: DNS bad TCP

G_W_Albrecht — Tue, 25 Jul 2023 13:37:46 GMT

Has also been dicussed her without a solution: Internal DNS was flooded by bad TCP-based DNS from Check Point

Re: DNS bad TCP

Chris_Atkinson — Tue, 25 Jul 2023 14:22:02 GMT

How does your version/JHF compare to that listed in the previous similar threads?

I see two SR's with similar symptoms but the cause was undetermined in each.

Re: DNS bad TCP

the_rock — Tue, 25 Jul 2023 14:03:52 GMT

I would contact TAC about this, honestly. I checked support site and literally only things that show up are community posts and specifically one that @G_W_Albrecht pointed to.

Andy

Re: DNS bad TCP

handiansudianto — Wed, 26 Jul 2023 01:13:40 GMT

i using version 81.10 with JHF 87

Re: DNS bad TCP

handiansudianto — Wed, 26 Jul 2023 01:16:50 GMT

on the sk 133313 there are 2 solution :

1. disable 'Log implied rules', i check this already disabled.

2. Change rad_kernel_domain_cache_refresh_interval and rad_kernel_domain_cache_ip_success_lookup_timeout. What value is recommended for both parameters?