Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 138 / 861

138 Establishing your network
About the security gateway’s implementation of DNS
;;
*)
echo "usage: $0 {start|stop}"
;;
esac
3 Save and close the file.
4 Restart the appliance.
Related information
For further information related to this topic, see the following:
■
“Allowing multicast traffic” on page 135
■
“How the security gateway handles multicast traffic” on page 136
■
“Multicast traffic through gateway-to-gateway IPsec tunnels” on page 403
About the security gateway’s implementation of DNS
The security gateway’s DNS implementation supports many of the features of RFC-defined (RFC 1334
and 1335) DNS, including full name resolution and reverse name resolution. What makes the security
gateway’s solution simpler for the administrator is that it defines both forward and reverse lookups in
one entry.
This section’s intent is not to teach you about DNS, but to help you know how to implement it on your
security gateway. For a complete description about DNS, refer to
DNS and Bind , 4th Edition, Paul Albitz
and Cricket Liu. O’Reilly & Associates, Inc., 2001. ISBN 0-596-00158-4.
Before configuring DNS, you should familiarize yourself with the differences between RFC-defined
DNS and the security gateway's DNS implementation (DNS proxy) prior to configuring it.
The security gateway offers many scenarios for implementing DNS. The scenario you choose depends
on how your current network is configured and your DNS objectives. Use the scenario descriptions
below to help you decide how to implement DNS for your network. The first scenario is to have a
caching name server and this option is configured by default out of the box. You may not have to do
any further configuration if this is the option you require.
Review the following DNS implementation scenarios:
■
Configuring a caching name server with no internal name server
■
Configuring a caching name server with an internal name server
■
Configuring an authoritative name server for a domain
■
Configuring an authoritative name server with delegation
■
Configuring enclave DNS
Configuring a caching name server with no internal name server
The security gateway has both client and server capabilities for the DNS proxy (DNS daemon). Other
computers in the network have clients as well. By default, the security gateway is a caching name
server and it is not authoritative for anything until configured. Authoritative only name servers are
name servers that deliver authoritative responses for a particular domain, and they do not cache. A
caching name server caches or saves DNS records. After configuring the security gateway and
rebooting, the security gateway’s resolver has 127.0.0.1 (localhost) listed as the primary name server.
At a minimum, 127.0.0.1 should remain at the top of the list when the DNS proxy is running. The
security gateway only acts as a primary name server, however you can configure a secondary name
server by using a host record.