Prevent the firewall from discarding DNS UDP sessions after a sinkhole or block
action so that subsequent queries on the same session are processed normally.
| Where Can I Use
This? | What Do I Need? |
|---|
When the firewall sinkholes or blocks a DNS query, the UDP session is placed in a
DISCARD state by default. Because DNS clients commonly reuse the same UDP source
port for multiple queries, subsequent requests that arrive on the same session tuple
are dropped without notification, resulting in intermittent DNS resolution
failures.
Enabling No DNS UDP Discard keeps the DNS UDP session active after a sinkhole or
block action, allowing subsequent queries on the same session to be inspected and
processed normally. The firewall still enforces the sinkhole or block verdict on the
triggering query but preserves the session state for future requests.
This setting applies when DNS queries are sinkholed or blocked in the following
scenarios:
- Sinkhole or block by EDL or content rules
- Sinkhole or block by traditional DNS Security (data plane (DP) cache hit, or
DP cache miss where the verdict is received before the DNS response)
- Sinkhole or block by Advanced DNS Security (DP cache hit, or DP cache miss where
the verdict is received before timeout)
This setting does not affect sessions discarded for other reasons, such as
resource exhaustion.
