Has anyone implemented EDNS on their network? How does the firewall treat it? Is it just as DNS? Does it block it because the packets are too big?
Does anyone know if there is a plan to make it its own discreet application?
Thanks for the info...
Solved! Go to Solution.
Today, we do not support the EDNS RFC 2671. Usually, if DNS servers enabled with EDNS tries to talk to a non-EDNS server, the non-EDNS servers will simply ignore the OPT request and will not negotiate a larger packet size.
However, I do see a feature request (FR) submitted to our development team to potentially add it to our upcoming releases. You can also request your account's SE to vote for it.
FR ID : 2315
Hope that information helps!
Thanks and regards,
To summarize my findings regarding EDNS:
If you are using BIND then add one of these values to your BIND config:
whatever floats your boat.
According to http://www.cisco.com/en/US/docs/security/asa/asa83/asdm63/configuration_guide/ddns.html one could say that:
- Old standard: max 512 bytes for UDP (DNS).
- New standard: max 4096 bytes for UDP (DNS).
- Microsoft standard: max 1280 bytes for UDP (DNS).
where 1280 seems to be connected to that 1280 is the smallest allowed MTU for IPv6 networks.
If the IPv6 stack does not support IPV6_USE_MIN_MTU, then steps
should be taken to prevent PMTUD occuring. These include, but are
not limited to, setting the MTU of the interface the packets are
being sent over to the minimum IPv6 MTU (1280 bytes), or restricing
DNS/UDP packets to no more than 1280 bytes including IPv6 headers.
Note that a 512-octet UDP payload requires a 576-octet IP
reassembly buffer. Choosing 1280 on an Ethernet connected
requestor would be reasonable. The consequence of choosing too
large a value may be an ICMP message from an intermediate
gateway, or even a silent drop of the response message.
1280 bytes of DNS data is chosen as the new default to provide a
generous allowance for IP headers and still be within the highly
prevalent approximately Ethernet size or larger MTU and buffering
generally available today.
An IPv6 server should enable fragmentation on UDP replies. While
fragmentation will not be frequent if the above guidelines are
followed, it may occur on occasion. In principle, IPv6 headers and
options could be huge, resulting in a very large UDP packet even
though the DNS payload is limited, but this should not occur in
Way to test if you are affected of any EDNS bugs in your infrastructure:
>dig +short rs.dns-oarc.net txt
and then check the logs of your firewalls etc.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!