Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 158 / 861

158 Establishing your network
About the security gateway’s implementation of DNS
2
On the DNS tab, select the appropriate DNS entry, and then click Properties .
3 In the DNS Properties dialog box, on the General tab, ensure that the Enable check box is checked.
Related information
None.
Understand why inside DNS lookups do not work
Ensure there is not a forwarder record to an internal DNS server unless that internal DNS server has
another route out, bypassing the security gateway or you have a GSP for DNS.
Ensure that your inside server has a forwarder record pointing to the security gateway and ensure
reverse lookups are unchecked in the Assets > Asset Parameters window. Be careful not to create a
loop.
If you are using the DNS proxy as your name server, check that the hosts file has your internal DNS
information.
Check that the security gateway is using localhost (the loopback address: 127.0.0.1) for its host record.
Note: Because the security gateway uses the loopback address (127.0.0.1) to pass DNS requests back to
itself, do not delete the address.
Related information
■
“Enabling reverse lookups” on page 157
Resolve other DNS problems
There are several settings that can cause problems with some features, as follows:
■
Outside computers cannot get addresses
Outside computers need to get name service from either the security gateway or an inside name
server. Otherwise, set the outside computer’s resolver to your service provider’s name server.
■
Cannot use some features
To use mail records, zone transfers, or subdomain delegation, the DNS proxy must be:
■
The registered authority for your domain
Check with your service provider to see if you are the registered authority for your domain.
■
Configured as an authoritative server
To configure your system as authoritative for a domain, add public and private authority
records for the domain to DNS Records.
Note: If you do not have a network outside your security gateway, you need to use CIDR addressing. If
you do not want to use CIDR addressing, a work-around would be to use your ISP’s name server to
provide name service for your outside network.