Mis-Categorisation of DNS Requests

[ISOffice]

Setup = 2 X FortiGate 100D Hardware Appliances (Active Passive) v5.2.8, build 727. NAT Mode.

Hi all,

We are experiencing a strange situation here and I was wondering if anyone had experienced something similar.

We are seeing entries in traffic logs which indicate DNS requests being made to the online FortiNet DNS Servers (208.91.112.53 & 208.91.112.52) from network clients. Nothing unusual there, but the Application Name being returned in the log entries is not DNS as expected but, WhatsApp & WhatsApp_File.Transfer.

Has anyone any suggestion as to why these DNS requests are being mis-classified in this way?

Many thanks,

John P

[ede_pfau · Accepted solution]

Not seen this before but you should open a ticket with Support so that the FortiGuard team is notified.

[ede_pfau · Accepted solution]

Not seen this before but you should open a ticket with Support so that the FortiGuard team is notified.

[ISOffice]

Many thanks ede_pfau,

I will bear that in mind and will post any answers that FortiNet supply.

Best regards,

John P

[SCSIraidGURU]

On my 60E, DNS throws IP Connection errors and other errors in the logs.   I think that the Fortigate IOS has problems properly resolving DNS inbound packets.  I have a ticket open. 

[ISOffice]

Hi SC,

Thank you for your contribution. I'm not seeing any errors as such in the logs, just a mis-categorisation of the application carrying out DNS requests. I also have a ticket open with FortiNet Support. Will post any developments.

Best regards,

John P

[ISOffice]

Hi all,

To demonstrate the issue we are having, here are extracts from Application Control & Traffic Logs showing requests from the same source IP (trust me, they are all from the same source IP) to the same destination IP on port 53. However, they are categorised differently: Application Control Log itime=1482176396 date=2016-12-19 time=19:39:56 devname=Fortigate-B23 devid=FG100Dxxxxxxxxxx logid=1059028704 type=utm subtype=app-ctrl eventtype=app-ctrl-all level=information vd="root" appid=28057 user="" srcip=XX.XX.XX.XX srcport=60631 srcintf="Wireless_Priv" dstip=208.91.112.53 dstport=53 dstintf="wan1" proto=17 service="NIA-PrivateServices" policyid=7 sessionid=263863845 applist="AppControlPrivate" appcat="Collaboration" app="WhatsApp" action=pass msg="Collaboration: WhatsApp," apprisk=elevated itime=1482176913 date=2016-12-19 time=19:48:33 devname=Fortigate-B23 devid=FG100Dxxxxxxxxxx logid=1059028704 type=utm subtype=app-ctrl eventtype=app-ctrl-all level=information vd="root" appid=16195 user="" srcip=XX.XX.XX.XX srcport=53728 srcintf="Wireless_Priv" dstip=208.91.112.53 dstport=53 dstintf="wan1" proto=17 service="NIA-PrivateServices" policyid=7 sessionid=263866472 applist="AppControlPrivate" appcat="Network.Service" app="DNS" action=pass msg="Network.Service: DNS," apprisk=elevated Traffic Log itime=1482176578 date=2016-12-19 time=19:42:58 devname=Fortigate-B23 devid=FG100Dxxxxxxxxxx logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=XX.XX.XX.XX srcport=60631 srcintf="Wireless_Priv" dstip=208.91.112.53 dstport=53 dstintf="wan1" poluuid=70966c68-5552-51e4-c995-1d5a53690c73 sessionid=263863845 proto=17 action=accept policyid=7 dstcountry="Canada" srccountry="Reserved" trandisp=snat transip=XX.XX.XX.XX transport=60631 service="NIA-PrivateServices" appid=28057 app="WhatsApp" appcat="Collaboration" apprisk=elevated applist="AppControlPrivate" appact=detected duration=181 sentbyte=61 rcvdbyte=336 sentpkt=1 rcvdpkt=1 utmaction=allow countapp=1 itime=1482177094 date=2016-12-19 time=19:51:34 devname=Fortigate-B23 devid=FG100Dxxxxxxxxxxlogid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=XX.XX.XX.XX srcport=60074 srcintf="Wireless_Priv" dstip=208.91.112.53 dstport=53 dstintf="wan1" poluuid=70966c68-5552-51e4-c995-1d5a53690c73 sessionid=263866471 proto=17 action=accept policyid=7 dstcountry="Canada" srccountry="Reserved" trandisp=snat transip=XX.XX.XX.XX transport=60074 service="NIA-PrivateServices" appid=16195 app="DNS" appcat="Network.Service" apprisk=elevated applist="AppControlPrivate" appact=detected duration=181 sentbyte=84 rcvdbyte=485 sentpkt=1 rcvdpkt=1 utmaction=allow countapp=1 I'm awaiting word back from FortiNet Support. Will post any developments.

Many thanks, John P

[SCSIraidGURU · Accepted solution]

They are Proto=17 or UDP. 

I am wondering what the diag traffic for dstport=53 or dnsproxy would show as the return packet.  We noticed an issue with my IP Connection Error on DNS when I enabled all session logging on the interfaces. 

[ISOffice]

Hi All,

Just a quick update in relation to this. FortiNet Support came back to me and stated:

"DNS traffic that originates in different applications can be identified as that application (so DNS traffic from WhatsApp will be identified as WhatsApp), but it varies depending on the application and what application signatures the FortiGate knows. Also, as multiple applications can run DNS requests, you can have multiple packets on UDP port 53 that the FortiGate will interpret as different applications based on what application it originated in."

This reads to me that there is very little that can be done in relation to this issue, just have to suck it up!

John P

[SCSIraidGURU]

I solved my IP Connection Error issue.   The Windows 7 workstation was sending DNS request for two Microsoft Teredo servers.  I blocked them in DNS filters.   We found them doing a sniffer on port 53. diag sniffer packet any 'host xx.xx.xx.xx and port 53' 6.  xx.xx.xx.xx is your wan port.   Did they do a similar sniffer for you.  

[ISOffice]

Hi SCSIraidGURU,

As far as I know they didn't carry out any sniffer testing, I just uploaded a copy of our configuration to them. My issue is that DNS requests are being mis-classified as other applications (WhatsApp, WhatsApp_File.Transfer, Sophos.Update & Opera.Turbo being the main culprits). FortiNet Support didn't offer any suggestions as to how this may be addressed, so it looks like something we'll have to live with.

Happy to hear you resolved your issue though.

Many thanks,

John P