The issue is EDNS. One rather brutal method is to teach your Win servers to not advertise EDNS: http://www.nthelp.com/w2k3/turning_off_edns.htm
However, since AI R54, checking of EDNS queries is officially supported by SmartDefense. If you are already using NG AI and you get these kind of errors, it can be considered a bug, most likely. Which can be investigated and fixed with the help of CP support, or your reseller's support. Regards Thorsten Behrens Senior Security Engineer CCMSE CCSE+ CCNA CNE INTEGRALIS Your Trusted Security Partner 111 Founders Plaza 13th Floor East Hartford, CT 06108 USA Tel: +1 860 291 0851 x 2244 Fax: +1 860 291 0847 [EMAIL PROTECTED] www.integralis.com > -----Original Message----- > From: Dahl-Stamnes J�rn [mailto:[EMAIL PROTECTED] > Sent: Tuesday, November 09, 2004 4:54 AM > To: [EMAIL PROTECTED] > Subject: Re: [FW-1] SmartDefense and dnssec > > > [EMAIL PROTECTED] Wrote: > > I just updated my SmartDefense and started getting a lot of > > 'Invalid DNS' > > entries in Tracker (info field is "Attack info: Badly formed > > DNS"). There > > was a very noticeable adverse impact on external browsing and > > downloads. > > > > Tech support tells me that the 'Badly formed DNS' message > is caused by > > dnssec and that by default, Fw-1 drops packets with dnssec > > enabled. They > > gave me a solution to disable the dsnssec check, which I did. > > Browsing and > > downloads are normal again. > > > > However, I would prefer to keep the dnssec check enabled. > > Has anyone run > > into this, and what other solutions did you implement in > > order to leave the > > default check enabled? My internal dns servers are Win2K. > > I have the same problems. Maybe you can share with me/other > how you disabled > the dnssec check? > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [EMAIL PROTECTED] > ================================================= > Please note that: 1. This e-mail may constitute privileged information. If you are not the intended recipient, you have received this confidential email and any attachments transmitted with it in error and you must not disclose, copy, circulate or in any other way use or rely on this information. 2. E-mails to and from the company are monitored for operational reasons and in accordance with lawful business practices. 3. The contents of this email are those of the individual and do not necessarily represent the views of the company. 4. The company does not conclude contracts by email and all negotiations are subject to contract. 5. The company accepts no responsibility once an e-mail and any attachments is sent. http://www.integralis.com ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
