| 12.3 |  | Attack Guards |
| 12.3.2 |  | DNS guard |

| In an attempt to resolve a name to an IP address, a host may query the same DNS server multiple times. The DNS Guard feature of the PIX Security Appliance recognizes an outbound DNS query and allows only the first answer from the server back through the PIX. All other replies from the same source are discarded. DNS Guard closes the UDP conduit that was opened by the DNS request after the first DNS reply and does not wait for the normal UDP timeout, which is 2 minutes by default. By closing out the UDP conduit as soon as it recognizes a response, the PIX Security Appliance can prevent attacks such as UDP session hijacking and certain types of Denial of Service (DoS) attacks.

In cases where a host queries several different DNS servers, the connection to each server is handled separately because each request is sent separately. For example, if the DNS resolver sends three identical queries to three different servers, the PIX Security Appliance creates three different connections. As the PIX Security Appliance receives a reply through each connection, it shuts down that single connection. It does not tear down all three connections because of the first reply. The DNS responses of all three servers queried are allowed through the firewall.

This DNS Guard feature is always enabled, and is therefore not configured on the PIX.