DNS Sessions

[ealfonso]

Guys, I have attached a printscreen of my FGT400. Basically i just want to know if any of you guys are experiencing the same thing with your fortinet device. Sometimes my session counts goes up really high, up to 14k and almost all of have a destination port of 53. I have 2 DNS servers on the DMZ sides on the 10.4.1.0/24 which serves as our external dns servers and I have 2 more DNS servers on the 10.3.3.0/24 which serves as the internal dns servers. For some reason i cannot attached the printscreen file i think the file size is too big. . I guess i just want to know if should be concern with the high number of port 53 sessions.

[rwpatterson]

We have 2 DNS servers (one on the LAN for inside users, and one on the DMZ as secondary and outside), and our port 53 traffic may peak at 1000.... Make sure the forwarding is configured correctly in the servers, and that extra traffic isn' t being generated erroneously...

[romanr]

That depends on how much DNS traffic and sessions you really have... I know installation, where there are external DNS servers, that utilize far more than 10K sessions each in normal production! So there might be a total number of 40K-50K just with UDP/53... But that shouldn' t be a problem for a FGT400(A?)... I wouldn' t do traffic logging on that policy ;)! cheers.roman

[ealfonso]

I have DNS forwarding enabled and just disabled recursion last night for the DNS servers on the DMZ side. I guess we will see today if that helps. Do you guys know how many real sessions can FGT400 handles not the marketing numbers?

[ealfonso]

Also I have set udp_src_session limit to 1000 and set it to drop session,will this change affect adversely any legitimate traffic?

[romanr]

Hi, udp_src_session limit -> Will do what it says, it will drop all sessions above 1000 from one single IP... This might cut off productive DNS traffic! This policy might as well put some real load on your Fortigate as well, far more then a normal policy!!!! Giving real session numbers isn' t easy, because it depends on lot of other things on the firewall! If its just the number of DNS sessions you have, there should be enough headroom! Just have a look at your CPU utilization! BTW: If you use any kind of DNS Blacklists to fight SPAM, this might be a reason for a high number of DNS sessions! cheers.roman

[lmuir]

Disabling recursion significantly reduced the number of sessions on my FGT.

[ealfonso]

Thank you guys for all the insight, so far so good with the changes i made.

[emnoc]

You might have something else going on. I found a compromised host on my network once, when I happen across one single host generating a ton of DNS lookups. We mirrored a port and ran tcpdump for udp and port 53 and to determine what that hosts was doing. fwiw, Unless your conducting business as a email-hosting or have a lot of email traffic, DNS sessions shouldn' t be that high. You might want to grab some dns traffic and investigate.