Solved

Juniper SSG5 UDP Flood Port 53, DNS Proxy module has more concurrent client requests than allowed

Posted on 2014-10-15
5
744 Views
Last Modified: 2015-04-22
About two days ago one of your retail locations called complaining about slow web browsing or no connectivity to the web. I logged into the Juniper to see what could be causing the issue and noticed a high number of UDP request being sent to port 53.

Here are the errors and warnings from the SSG5, I am not sure where to begin with troubleshooting to resolve this issue. Any assistance would be greatly appreciated. Thanks


"DNS Proxy module has more concurrent client requests than allowed."

=============================================================================
System Event Log (Current system time: Wed, 15 Oct 2014 10:08:25)
=============================================================================
      Date     Time   Module  level   Type  Description

2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 78.112.104.150:6274 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 78.112.104.150:31474 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 95.107.68.127:343 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 80.159.7.30:42588 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 57.177.142.172:16 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 101.90.218.242:41896 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 121.70.197.255:46733 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 24.72.157.4:52116 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 38.215.133.121:53543 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.112.104.150:6277 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.112.104.150:27199 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 206.190.153.228:16125 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.112.104.150:59762 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.239.245.20:37108 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 84.52.218.31:32905 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:22   system   crit  00430  Dst IP session limit! From 13.70.124.171:38199 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:22   system   crit  00430  Dst IP session limit! From 78.112.104.150:8157 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:22   system   crit  00430  Dst IP session limit! From 71.84.230.6:29360 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
0
Comment
Question by:PMICORP
  • 3
  • 2
5 Comments
 
LVL 18

Expert Comment

by:Sanga Collins
Comment Utility
If this is DUP53 traffic coming from the untrust zone into your trust zone, I would make a rule that rejects the traffic. There is no reason unless you are hosting a  DNS server for this traffic to occur.
0
 

Author Comment

by:PMICORP
Comment Utility
Thanks for the quick reply, could you elaborate on how to create this rule to block this unwanted traffic.
0
 
LVL 18

Expert Comment

by:Sanga Collins
Comment Utility
If you got to the web interface for your Juniper,

You can go to Policy > Policies.
Change "from" field to untrust and "to" field to trust then click "new" in the top right corner.

You can then configure the policy as shown in the attachment. Take note of the service section. I made the service DNS (you can make more customized ones if needed) I also set the action to "reject" instead of deny so that the traffic is dropped. Very important as well is to enable logging so that you can view whats happening on your device.
security-policy.jpg
0
 

Author Comment

by:PMICORP
Comment Utility
I have made the changes to add this policy with the settings you recommended, nothing shows in the log and I am still receiving the alerts...
0
 
LVL 18

Accepted Solution

by:
Sanga Collins earned 500 total points
Comment Utility
Ok looks like you may have an issue with session limits. You can run the following command from the CLI

set zone untrust screen alarm-without-drop

this will stop the firewall from dropping packets, but still show the log entries so you can track down what computer or application is causing the problem.

Also make sure you have a global deny policy with logging enabled. This allows you to see all traffic that does not match any of the allow policies. it would be from global to global, source any, dest any, service any, action deny.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Suggested Solutions

SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now