Subject: RE: internal DNS issue

From: Malcolm Tester <[email-masked]>
Date: Tue, 12 Dec 2000 09:19:33 -0700

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

I have an internal DNS server (not on the firewall) for internal name
resolution.  I have it set up to use the firewall as a "forwarder" for
external name resolution.

The firewall has an external DNS server on it, but it has _NO_ knowledge of
the internal DNS and can't resolve internal names unless they are
specifically defined in the "hosts" file.  Which is not recommended.

Regards,
Malcolm

-> -----Original Message-----
-> From: Barreira, Fernando [IT] [mailto:[email-masked]]
-> Sent: Monday, December 11, 2000 2:55 PM
-> To: [email-masked]'
-> Subject: internal DNS issue
-> 
-> 
-> [To be removed from this list send the message "unsubscribe 
-> fwtk-users" in the
-> BODY of a mail message to [email-masked].]
-> 
-> hi there,
-> 
-> can you please share some information on the following:
-> 
-> 1. does the fwtk require the machine it's installed on to 
-> have two separate
-> DNS servers specified, one for external    (internet) DNS 
-> resolution and the
-> other to resolve our internal network machine names?
-> 
-> 2. if i only setup external DNS is configured, will the 
-> machine try to
-> resolve internal machine names using the external DNS?
-> 
-> thanks
->

---

From: Michel Bardiaux <[email-masked]>
Date: Tue, 12 Dec 2000 17:40:19 +0100

> specifically defined in the "hosts" file.  Which is not recommended.
Why is it not recommended? The FWTK attempts to reverse-lookup *all*
connection attempts, whether they come from outside or from the internal
net. Seems to me that implies FWTK expects *some* resolver for the
internal hosts, and /etc/hosts seems to me safer (not to mention easier)
than trying to setup one's own DNS map. If /etc/hosts is a security
risk, then the FWTK should not attempt reverse-lookup on internal
addresses, is there a netperm-table command for that?

-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10