Implied rule for DNS Accept domain name over UDP queries.

[kaustubh]

In my scenario we have enabled implied rule for DNS "Accept domain name over UDP queries." as before last in Global properties.

In logs i can see lot of company machines to external DNS servers (hitting on implied rule) my task is disable option "Accept domain name over UDP queries." from Global properties.

Question as :

1 I already have my internal DNS specified in explicit rule. but still few user machines hitting external DNS server hitting through implied rule. is there any specific reason of this behavior ?

2 In above scenario if i directly disable option "Accept domain name over UDP queries. as before last" will  it have any impact ?

[_Val_]

1. Implied rule for DNS is looking as "ANY--ANY--domain-UDP--Accept", so if you choose "First" option for that, all DNS traffic will go through an implied rule.

2. If you choose "Before Last", make sure none on explicit rules drops DNS, just in case. In other words, check drop rules in the policy, to answer your question.

That said, it DNS through implied rules is not enable by default, as you may need to control this traffic properly, with tighter rules.

[kaustubh]

Hello Val,

Sorry for delay.

current implied rule for "queries over UDP" set as "Before Last".. but i have defined my internal DNS server as well in explicit rule.. but still i can see random ip's are trying to connect to external DNS servers..( my task is to disable option "queries over UDP".i have fear if i directly disable it then legitimate traffic may get break.

what could be the possible reason of that ? 

[Chris_Atkinson]

What are the random IPs and how is their DNS settings configured?

[kaustubh]

I checked few windows machines/fw's & their DNS servers in N/W adaptor is my internal DNS server only.. but still logs showing these devices are trying to connect nearest ISP's DNS servers.