DNS Proxy - invalid EDNS response

Announcements

Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

Reply
AKufner
L0 Member

DNS Proxy - invalid EDNS response

Hi all,

 

I'm having a issue with the DNS Proxy feature. I'm running a Palo Alto VM (9.1.8) in Azure and want to use the VM as DNS Proxy. As default DNS Server, I want to use AZURE DNS 168.63.129.16. Additionally I have some Proxy Rules for internal Domains via VPN to our On Prem Datacenter (DNS). 

 

DNS Lookups for On Prem are fine, but resolution via AZURE DNS is dropped. Im getting following Error in the DNS Logs 

 

2021-03-24 15:34:44.629 +0100 Error: pan_dnsproxy_process_server_pkt(pan_dnsproxy_pkt.c:1563): [AZURE DNS Proxy/42214/19678/Afacebook.com.]:[Drop Rcvd Server Pkt]: invalid EDNS response!
2021-03-24 15:34:44.629 +0100 Error: pan_dnsproxy_recv_server_udp_cb(pan_dnsproxy_udp.c:222): [udp]: fd 17 from 168.63.129.16 to 0.0.0.0 process server failed! 

 

I captured the Traffic to the AZURE DNS Server. Looks ok for me, the only thing i noticed is that the request querry is missing the additional OPT header. 

AKufner_0-1616596994150.png

 

Any Advice on this issue would be great. 

Thanks a lot  

 


Accepted Solutions
OtakarKlier
Cyber Elite

Hello,

When it comes to DNS, I highly recommend a secure DNS provider andnot one that will resolve anything. PaloAlto has one as a subscription, however there are others that are low cost/free you can use, OpenDNS, Quad9, etc.

 

This way you're protected from bad DNS using malware, etc.

 

https://skrzsecurity.net/securedns

 

Regards,

View solution in original post


All Replies
NikolayDimitrov
L4 Transporter

The EDNS OPT is described in https://tools.ietf.org/html/rfc6891 and this is extended DNS. There is an article with the same issue :


https://live.paloaltonetworks.com/t5/general-topics/edns0-packet-blocked/td-p/6789


As I don't see for Palo Alto to have made the option to allow EDNS, better check the Azure DNS config or ask their support to stop sending OPT records.Maybe the DNS message is too big or Azure are not following the standard for EDNS very well. The firewall normally should allow EDNS but it will not look at the EDNS data as it is not supported.


Seach the forum as there is much info about EDNS and the OPT and the request for enchancment FR ID : 2315 to Palo Alto.


If you see any Anti-Spyware signature under the Threats log for this, you may also stop it. Also test if enabling or disabling "Cache EDNS Responses" on the Firewall DNS proxy config will help. Outside of this check the Azure DNS and with their TAC.

OtakarKlier
Cyber Elite

Hello,

When it comes to DNS, I highly recommend a secure DNS provider andnot one that will resolve anything. PaloAlto has one as a subscription, however there are others that are low cost/free you can use, OpenDNS, Quad9, etc.

 

This way you're protected from bad DNS using malware, etc.

 

https://skrzsecurity.net/securedns

 

Regards,

View solution in original post

AKufner
L0 Member

Thank you all for the feedback. For further testing we will setup a Free DNS Proxy solution. 

 

Would be just easy for our POC in AZURE to use the Palo, but why should it be easy. 

One more thing i found out, a DNS request with "dig" works. With DIG the client adds in the request the OPT header and the Palo don't drops the request. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!