Solved

Juniper SSG5 UDP Flood Port 53, DNS Proxy module has more concurrent client requests than allowed

Posted on 2014-10-15
5
900 Views
Last Modified: 2015-04-22
About two days ago one of your retail locations called complaining about slow web browsing or no connectivity to the web. I logged into the Juniper to see what could be causing the issue and noticed a high number of UDP request being sent to port 53.

Here are the errors and warnings from the SSG5, I am not sure where to begin with troubleshooting to resolve this issue. Any assistance would be greatly appreciated. Thanks


"DNS Proxy module has more concurrent client requests than allowed."

=============================================================================
System Event Log (Current system time: Wed, 15 Oct 2014 10:08:25)
=============================================================================
      Date     Time   Module  level   Type  Description

2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 78.112.104.150:6274 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 78.112.104.150:31474 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 95.107.68.127:343 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 80.159.7.30:42588 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 57.177.142.172:16 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 101.90.218.242:41896 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 121.70.197.255:46733 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 24.72.157.4:52116 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 38.215.133.121:53543 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.112.104.150:6277 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.112.104.150:27199 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 206.190.153.228:16125 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.112.104.150:59762 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.239.245.20:37108 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 84.52.218.31:32905 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:22   system   crit  00430  Dst IP session limit! From 13.70.124.171:38199 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:22   system   crit  00430  Dst IP session limit! From 78.112.104.150:8157 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:22   system   crit  00430  Dst IP session limit! From 71.84.230.6:29360 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
0
Comment
Question by:PMICORP
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 18

Expert Comment

by:Sanga Collins
ID: 40382406
If this is DUP53 traffic coming from the untrust zone into your trust zone, I would make a rule that rejects the traffic. There is no reason unless you are hosting a  DNS server for this traffic to occur.
0
 

Author Comment

by:PMICORP
ID: 40382431
Thanks for the quick reply, could you elaborate on how to create this rule to block this unwanted traffic.
0
 
LVL 18

Expert Comment

by:Sanga Collins
ID: 40382466
If you got to the web interface for your Juniper,

You can go to Policy > Policies.
Change "from" field to untrust and "to" field to trust then click "new" in the top right corner.

You can then configure the policy as shown in the attachment. Take note of the service section. I made the service DNS (you can make more customized ones if needed) I also set the action to "reject" instead of deny so that the traffic is dropped. Very important as well is to enable logging so that you can view whats happening on your device.
security-policy.jpg
0
 

Author Comment

by:PMICORP
ID: 40382513
I have made the changes to add this policy with the settings you recommended, nothing shows in the log and I am still receiving the alerts...
0
 
LVL 18

Accepted Solution

by:
Sanga Collins earned 500 total points
ID: 40382613
Ok looks like you may have an issue with session limits. You can run the following command from the CLI

set zone untrust screen alarm-without-drop

this will stop the firewall from dropping packets, but still show the log entries so you can track down what computer or application is causing the problem.

Also make sure you have a global deny policy with logging enabled. This allows you to see all traffic that does not match any of the allow policies. it would be from global to global, source any, dest any, service any, action deny.
0

Featured Post

Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco ASA 5512 LAN Config 16 127
Migrate Windows checkpoint management server R75.40 to GAIA 4 56
Dlink-DIR 816 router 4 59
Mac address in Nexus7K fex port 5 37
Cybersecurity has become the buzzword of recent years and years to come. The inventions of cloud infrastructure and the Internet of Things has made us question our online safety. Let us explore how cloud- enabled cybersecurity can help us with our b…
Read about achieving the basic levels of HRIS security in the workplace.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

740 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question