Seeing DNS Tunnel traffic to/from our Public Ranges?

[JoshVogel0]

Hello,

This past week I've started seeing traffic that's classified as Tunneling:isavscan.[tld] (threat type: dns-c2, ThreatID: 109001001) hitting our Outside intrazone rule where the source and destination are our public ARIN IPs (the rule is currently set to allow while I make sure I have all the traffic we need like BGP and IPSec allowed in other rules). Even more strange, the traffic always seems to be going to the next adjacent IP (so from 1.1.1.1 -> 1.1.1.2, or 1.1.1.200 -> 1.1.1.199), and it's even involving IPs that we don't currently have NATed to anything.

My only guess is some kind of reflection attack, but it's been really low volume, 84 sessions since 3/31. Has anyone seen something like this before? Any thoughts on what attack strategy could be at play, or if there's anything I should do? 

Here's a sample of the threat logs:

[OtakarKlier]

Hello,

If you are not hosing any services that need an inbound NAT, I would recommend you block/drop all external traffic. I always have a DENY ALL policy as my last policy that blocks any any any traffic. This would also block the traffic you are seeing. 

Hope that makes sense.

Regards,

[JoshVogel0]

Thanks, but we do host many externally available services. I am working on blocking all unspecified Outside-Untrust to Outside-Untrust traffic which, as you say, will block this traffic too, but am making sure I do so without affecting BGP/IPSec/VPN in the process. I was more curious what this strange traffic could indicate. C2 would imply we have compromised hosts, but if that was the case the source IP would be one of our internal IPs, not external. It also doesn't account for why some of our unused external IPs were also taking part.

[OtakarKlier]

Hello,

First put into place policies that allow the traffic you want to see, BGP/IPSec/VPN (source and destination). Then once you see those policies start to be hit for the traffic you want, then put in the blocking policy.

If the traffic was sourced from external and is destination is external, then I doubt its an internal C2 since the traffic would then be sourced from inside. Looks like a scan from the threat info.

Regards,