DNS problems to RoadRunner - tcp vs udp

Fri Jun 13 19:59:48 UTC 2008

Jon Kibler wrote:
> Various hardening documents for Cisco routers specify the best practices
> are to only allow 53/tcp connections to/from secondary name servers.
> Plus, from all I can tell, Cisco's 'ip inspect dns' CBAC appears to only
> handle UDP data connections and anything TCP would be denied. From what
> you are saying, the hardening recommendations are wrong and that CBAC
> may break some DNS responses. Is this correct?

A number of Cisco default from years gone by would break DSN, today, in 
it's current form.  Such as how PIXs and ASAs with fixup/DPI would block 
  udp/53 packets larger than 512 bytes, not permitting EDNS packets through.

> Also, other than "That's what the RFCs call for," why use TCP for data
> exchange instead of larger UDP packets?