2.3 Ensure 'DNS Guard' is enabled

Information

Enables the protection against DNS cache poisoning attacks

Rationale:

A DNS cache is poisoned when it contains incorrect entries that redirect traffic to an attacker website. When the DNS queries performed towards legitimate DNS servers, attackers can spoof the Identifier of the DNS header along with the DNS caching server UDP port in order to provide a reply as from an authoritative DNS server. The DNS Guard function helps eliminating subsequent replies coming after the authoritative server reply.

Solution

Run the following command to enable the DNS Guard function.

HOSTNAME(CONFIG)# DNS-GUARD

See Also

https://workbench.cisecurity.org/files/1903

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-2, CSCv7|11.1

Plugin: Cisco

Control ID: a9bc0e1f5714ae71f32c1d00b2533cda83aa31bfdec4b7fcc16868a461e20b11