Solved

Juniper SSG5 UDP Flood Port 53, DNS Proxy module has more concurrent client requests than allowed

Posted on 2014-10-15
5
843 Views
Last Modified: 2015-04-22
About two days ago one of your retail locations called complaining about slow web browsing or no connectivity to the web. I logged into the Juniper to see what could be causing the issue and noticed a high number of UDP request being sent to port 53.

Here are the errors and warnings from the SSG5, I am not sure where to begin with troubleshooting to resolve this issue. Any assistance would be greatly appreciated. Thanks


"DNS Proxy module has more concurrent client requests than allowed."

=============================================================================
System Event Log (Current system time: Wed, 15 Oct 2014 10:08:25)
=============================================================================
      Date     Time   Module  level   Type  Description

2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 78.112.104.150:6274 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 78.112.104.150:31474 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 95.107.68.127:343 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 80.159.7.30:42588 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 57.177.142.172:16 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 101.90.218.242:41896 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 121.70.197.255:46733 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 24.72.157.4:52116 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 38.215.133.121:53543 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.112.104.150:6277 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.112.104.150:27199 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 206.190.153.228:16125 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.112.104.150:59762 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.239.245.20:37108 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 84.52.218.31:32905 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:22   system   crit  00430  Dst IP session limit! From 13.70.124.171:38199 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:22   system   crit  00430  Dst IP session limit! From 78.112.104.150:8157 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:22   system   crit  00430  Dst IP session limit! From 71.84.230.6:29360 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
0
Comment
Question by:PMICORP
  • 3
  • 2
5 Comments
 
LVL 18

Expert Comment

by:Sanga Collins
ID: 40382406
If this is DUP53 traffic coming from the untrust zone into your trust zone, I would make a rule that rejects the traffic. There is no reason unless you are hosting a  DNS server for this traffic to occur.
0
 

Author Comment

by:PMICORP
ID: 40382431
Thanks for the quick reply, could you elaborate on how to create this rule to block this unwanted traffic.
0
 
LVL 18

Expert Comment

by:Sanga Collins
ID: 40382466
If you got to the web interface for your Juniper,

You can go to Policy > Policies.
Change "from" field to untrust and "to" field to trust then click "new" in the top right corner.

You can then configure the policy as shown in the attachment. Take note of the service section. I made the service DNS (you can make more customized ones if needed) I also set the action to "reject" instead of deny so that the traffic is dropped. Very important as well is to enable logging so that you can view whats happening on your device.
security-policy.jpg
0
 

Author Comment

by:PMICORP
ID: 40382513
I have made the changes to add this policy with the settings you recommended, nothing shows in the log and I am still receiving the alerts...
0
 
LVL 18

Accepted Solution

by:
Sanga Collins earned 500 total points
ID: 40382613
Ok looks like you may have an issue with session limits. You can run the following command from the CLI

set zone untrust screen alarm-without-drop

this will stop the firewall from dropping packets, but still show the log entries so you can track down what computer or application is causing the problem.

Also make sure you have a global deny policy with logging enabled. This allows you to see all traffic that does not match any of the allow policies. it would be from global to global, source any, dest any, service any, action deny.
0

Featured Post

Connect further...control easier

With the ATEN CE624, you can now enjoy a high-quality visual experience powered by HDBaseT technology and the convenience of a single Cat6 cable to transmit uncompressed video with zero latency and multi-streaming for dual-view applications where remote access is required.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the hope of saving someone else's sanity... About a year ago we bought a Cisco 1921 router with two ADSL/VDSL EHWIC cards to load balance local network traffic over the two broadband lines we have, but we couldn't get the routing to work consi…
Shadow IT is coming out of the shadows as more businesses are choosing cloud-based applications. It is now a multi-cloud world for most organizations. Simultaneously, most businesses have yet to consolidate with one cloud provider or define an offic…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question