DNS big text threat seems to bypass security rule

[mkeller]

I have a strange circumstance here, I think. I've received several threats in my threat log for "DNS Answer Big TXT Record Response Anomaly" Threat ID 31580 (not sure if that's relevant or not, it just seems an odd similarity)

So yesterday I had a few instances of this threat from a particular IP. My usual response (like it or not) when I see threats that come through with an action of "allow" or "alert" and I see multiple atempts from the same source IP (and I can't refute the assumption that this is a threat and not mis-classified normal traffic) is to add the IP as a recognized address and put it in a group for "blocked IP's." I have a security rule that says to deny from the source in the "blocked IP's" group and coming in on the L3-untrust zone (which is where this threat comes in) and to any destination on L3-trust zone (which is the destination on these threats). So that's my setup, and I went to add this IP that got through yesterday to the block list, but it's already in the block list. Busy day yesterday, so I forgot about it - if the same IP tries again, I'll see it the next day.

So today I have the exact same circumstance with a different IP. So it seems that I have these threats that are for some reason ignoring the first security rule I have in place and making it through to the threat processor, where they're getting "allowed" or "alerted"

Thoughts on how this could be happening? my only other thought at this point is to try rebooting the firewall, but that seems far-fetched - why are all my other security rules working, and it's just these two IP's with this common threat that's getting through?

[santonic]

Because it's DNS answer. Session initiator (DNS query) is probably one of your DNS servers so session is allowed and response can come back.