Subject: internal DNS issue

From: "Barreira, Fernando [IT]" <[email-masked]>
Date: Mon, 11 Dec 2000 16:54:53 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

hi there,

can you please share some information on the following:

1. does the fwtk require the machine it's installed on to have two separate
DNS servers specified, one for external    (internet) DNS resolution and the
other to resolve our internal network machine names?

2. if i only setup external DNS is configured, will the machine try to
resolve internal machine names using the external DNS?

thanks

---

From: Joseph S D Yao <[email-masked]>
Date: Tue, 12 Dec 2000 13:26:26 -0500

On Mon, Dec 11, 2000 at 04:54:53PM -0500, Barreira, Fernando [IT] wrote:
...
> other to resolve our internal network machine names?

It's best to have an internal DNS server for internal names and an
external DNS server for external names.  There's no need to have them
both on the firewall, and there is some thought that having neither on
the firewall might be best.  You will need to run DNS on the firewall,
even if without any authoritative zones at all, to proxy internal
requests for Internet information.

> resolve internal machine names using the external DNS?

The machine will try to resolve names using whatever YOU tell it to do.
You should specify the INTERNAL name server in the firewall's
/etc/resolv.conf file.  The internal name server should forward all
unresolved queries to the firewall.

The "DNS and BIND" book by Albitz & Liu [3rd ed., "soon" to be 4th] is
the best reference so far.  However, you should use BIND 8.2.2-P7 or
later, and the documention for everything past 8.1.2 needs to be found
in the BIND package.  This includes some uses of forwarding.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.