Verifying DNS Lists - FMC
We are back with another post about Cisco's Firepower Management Center and this time we are working with the DNS list which if you have a protect license you can have your Firepower modules or your FTD (Firepower Threat Defense) devices look at DNS requests and deny the requests if they are malicious. These have to be applied on your access control policy to be able to use it and in this post we are going verify some of the domain names that are in this lists.
So this post is already assuming that you have an Access Control Policy deployed on a Firepower Module (ASA) or a FTD. We also are assuming that you have a DNS policy applied to the FM/FTD. These lists get downloaded about every two hours from Cisco and are updated regularly, best to keep it that way. :) However like everything there is always someone, some system, some program that fails to connect and more often than not it's usually this critical process that worked yesterday but doesn't today, so how do we check if we are hitting this?
There are two ways to check this we can look at the connection events (if you are logging which by default is yes) it will show DNS the events and depending on your policy you'll see the action taken. In this example we selected to use Domain Not Found for the action. In this example we can see Domain Not Found and we can also see the DNS category its hitting which is DNS Dga.
Note: I have edited this screenshot to show example.com instead of the malicious domain
We can verify the domain is in this list DNS Dga by connecting to the FMC via SSH and browse to the actual list which is located at /var/sf/sidns_download. When you browse to this location you'll see something like this:
1admin@FMC:/var/sf/sidns_download$ 2admin@FMC:/var/sf/sidns_download$ ls 3032ba433-c295-11e4-a919-d4ae5275b77b Cisco_DNS_Intelligence_Feed 41b117672-7453-478c-be31-b72e89ca2dde IPRVersion.dat 523f2a124-8278-4c03-8c9d-d28fe08b71ab abdc925f-4f85-4504-90a7-c891979ad82a 62CCDA18E-DDFF-4F5C-AF9A-F00985219707 b1df3aa8-2841-4c88-8e64-bfaacec7111f 72b15cb6f-a3fc-4e0e-a342-ccc5e5804576 d7d996a6-6b92-4a56-8f10-e8506e432fb8 830f9e69c-d64c-479c-821d-0e4edab8348d health 93e2af68e-5fc8-4b1c-b5bc-b4e7cab5abcd health_status 105a0b6d6b-e2c3-436f-b4a1-48248b331d39 health_statuslock 115f8148f1-e5e4-427a-aa3b-ee1c2745d663 peers 1260f4e2ab-d96c-44a0-bd38-830252b65259 rep_dd.yaml 136ba968f4-7a25-4793-a2c8-7cc77f1f1074 tmp 14A27C6AAE-8E52-4174-A81A-47C59FECd3a5
Each of these UIDs correspond to DNS feed. For example b1df3aa8-2841-4c88-8e64-bfaacec7111f is for DNS Dga category. You can easily figure out which UID is tied to which DNS category by using the more command, notice the top of the file.
Note: I have replaced these domains with examples instead of the malicious domains
1admin@FMC:/var/sf/sidns_download$ more b1df3aa8-2841-4c88-8e64-bfaacec7111f 2#Cisco DNS and URL intelligence feed: DNS Dga 3example.info 4example.com 5example.net 6...
We can see in this example that the domain we where trying to resolve is in this blacklist. Usually you'll have to grep the file to find the domain as these lists can be big, to find a domain follow this command, I'm looking in the DNS Dga category.
1admin@FMC:/var/sf/sidns_download$ more b1df3aa8-2841-4c88-8e64-bfaacec7111f |grep example.com 2example.com 3admin@FMC:/var/sf/sidns_download$
This confirms it and we can can either whitelist it or drop the category and then redeploy polices, unless you run into a bug, which I have ran into with whitelisting as it does not seem to work with some older firepower code. Another upgrade is in the works, in the meantime I dropped the DNS category, I hope this information is helpful, - Ryan