47-7
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter47 Configuring Inspection of Basic Internet Protocol s
DNS Inspection
•Delete—Deletes a DNS class map.
Modes
The following table shows the modes in which this feature is available:
Add/Edit DNS Match Criterion
The Add/Edit DNS Match Criterion dialog box is accessible as follows:
Configuration> Global Objects > Class Maps > DNS > Add/Edit DNS Traffic Class Map >
Add/Edit DNS Match Criterion
The Add/Edit DNS Match Criterion dialog box lets you define the match criterion and value for the DNS
class map.
Fields
•Match Type—Specifies whether the class map includes traffic that matches the criterion, or traffic
that does not match the criterion.
For example, if No Match is selected on the string “example.com,” then any traffic that contains
“example.com” is excluded from the class map.
•Criterion—Specifies which criterion of DNS traffic to match.
–
Header Flag—Match a DNS flag in the header.
–
Type—Match a DNS query or resource record type.
–
Class—Match a DNS query or resource record class.
–
Question—Match a DNS question.
–
Resource Record—Match a DNS resource record.
–
Domain Name—Match a domain name from a DNS query or resource record.
•Header Flag Criterion Values—Specifies the value details for the DNS header flag match.
–
Match Option—Specifies either an exact match or match all bits (bit mask match).
–
Match Value—Specifies to match either the header flag name or the header flag value.
Header Flag Name—Lets you select one or more header flag names to match, including AA
(authoritative answer), QR (query), RA (recursion available), RD (recursion denied), TC
(truncation) flag bits.
Header Flag Value—Lets you enter an arbitrary 16-bit value in hex to match.
•Type Criterion Values—Specifies the value details for the DNS type match.
–
DNS Type Field Name—Lists the DNS types to select.
A—IPv4 address
NS—Authoritative name server
Firewall Mode Security Context
Routed Transparent Single
Multiple
Context System
••••—