Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 153 / 861

153 Establishing your network
About the security gateway’s implementation of DNS
7
Click OK .
8 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
Related information
For further information related to this topic, see the following:
■
“DNS TXT Record Properties—General tab” on page 683
■
“DNS TXT Record Properties—Text tab” on page 684
■
“DNS TXT Record Properties—Description tab” on page 684
DNS alternatives
There are many aspects of the DNS proxy that make it the most reliable way to provide name
resolution to the internal hosts and provide public authoritative responses. If you need to alter the
default settings, you can optimize the DNS proxy. One of the strengths of the DNS proxy is that it is a
non-transparent proxy. This feature provides a strong security stance, but in some situations you may
find it too restrictive for your needs. There are two methods to bypass the DNS proxy for situations
where other name servers or hosts inside of the security gateway require direct access to name servers
outside of the security gateway, these options include:
■
Using GSP with native service for passing DNS traffic
■
Using a forwarding filter to pass DNS traffic
■
Optimizing the DNS proxy
Using GSP with native service for passing DNS traffic
One option for passing DNS traffic is to create a Generic Service Proxies (GSPs) for the Transmission
Control Protocol (TCP) and the User Datagram Protocol (UDP) 53 (destination port). A GSP is not as
efficient as DNSd since a GSP does not support DNS caching, as the DNS proxy under high load, but it
provides an option for retaining security features like network address translation and flag checks.
Previously, a GSP required disabling the DNS proxy to avoid conflicts caused by having both the DNS
proxy and the udp_gsp servicing port 53. However, ancillary services rely upon the local DNS proxy
implementation and may be disrupted, including mail notifications, spoof protection, the ability to
control traffic in rules by host or domain name (deny rule by domain, for example), host names in logs,
and the -r option for flatten8.
You can pass native traffic, such as DNS, through the security gateway, without disabling the service.
This feature is called native service, or “To and Through,” and removes the need to disable the DNS
proxy to pass DNS traffic on a custom protocol. This feature lets the DNS proxy intelligently view
inbound DNS traffic and determine whether it is destined to the proxy or a host on the other side.
Prerequisites
None.
To configure GSP with native service for passing DNS traffic
1 In the SGMI, in the left pane, under Assets, click Protocols .
2
In the right pane, on the Protocols tab, click dns_udp , and then click Properties .
3 In the TCP UDP Based Protocol Properties dialog box, check Use native service, and then verify
that the Native service port is set to the default value of 54.