Juniper SSG5 UDP Flood Port 53, DNS Proxy module has more concurrent client requests than allowed

About two days ago one of your retail locations called complaining about slow web browsing or no connectivity to the web. I logged into the Juniper to see what could be causing the issue and noticed a high number of UDP request being sent to port 53.

Here are the errors and warnings from the SSG5, I am not sure where to begin with troubleshooting to resolve this issue. Any assistance would be greatly appreciated. Thanks


"DNS Proxy module has more concurrent client requests than allowed."

=============================================================================
System Event Log (Current system time: Wed, 15 Oct 2014 10:08:25)
=============================================================================
      Date     Time   Module  level   Type  Description

2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 78.112.104.150:6274 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 78.112.104.150:31474 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 95.107.68.127:343 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 80.159.7.30:42588 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 57.177.142.172:16 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 101.90.218.242:41896 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:24   system   crit  00430  Dst IP session limit! From 121.70.197.255:46733 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 24.72.157.4:52116 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 38.215.133.121:53543 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.112.104.150:6277 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.112.104.150:27199 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 206.190.153.228:16125 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.112.104.150:59762 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 78.239.245.20:37108 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:23   system   crit  00430  Dst IP session limit! From 84.52.218.31:32905 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:22   system   crit  00430  Dst IP session limit! From 13.70.124.171:38199 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:22   system   crit  00430  Dst IP session limit! From 78.112.104.150:8157 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
2014-10-15 10:08:22   system   crit  00430  Dst IP session limit! From 71.84.230.6:29360 to xxx.xxx.xxx.xxx:53, proto UDP (zone Untrust, int ethernet0/0). Occurred 1 times.
PMICORPAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Sanga CollinsSystems AdminCommented:
If this is DUP53 traffic coming from the untrust zone into your trust zone, I would make a rule that rejects the traffic. There is no reason unless you are hosting a  DNS server for this traffic to occur.
0
PMICORPAuthor Commented:
Thanks for the quick reply, could you elaborate on how to create this rule to block this unwanted traffic.
0
Sanga CollinsSystems AdminCommented:
If you got to the web interface for your Juniper,

You can go to Policy > Policies.
Change "from" field to untrust and "to" field to trust then click "new" in the top right corner.

You can then configure the policy as shown in the attachment. Take note of the service section. I made the service DNS (you can make more customized ones if needed) I also set the action to "reject" instead of deny so that the traffic is dropped. Very important as well is to enable logging so that you can view whats happening on your device.
security-policy.jpg
0
PMICORPAuthor Commented:
I have made the changes to add this policy with the settings you recommended, nothing shows in the log and I am still receiving the alerts...
0
Sanga CollinsSystems AdminCommented:
Ok looks like you may have an issue with session limits. You can run the following command from the CLI

set zone untrust screen alarm-without-drop

this will stop the firewall from dropping packets, but still show the log entries so you can track down what computer or application is causing the problem.

Also make sure you have a global deny policy with logging enabled. This allows you to see all traffic that does not match any of the allow policies. it would be from global to global, source any, dest any, service any, action deny.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.