Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual, Page: 154 / 861

154 Establishing your network
About the security gateway’s implementation of DNS
4
Click OK .
5 On the Service Groups tab, select the service group to which you want to add the dns_udp protocol,
and then click
Properties .
6 In the Service Group Properties dialog box, on the Protocols tab, click Add .
7 In the Select Protocols dialog box, under Search, in the drop-down list, click Starts with .
8 In the text box to the right of Search, type dns , and then click Search .
9 Under Network Protocol, click dns_udp , and then select one of the following:
10 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
11 Create a new rule, using the newly modified service group.
Related information
For further information related to this topic, see the following:
■
“TCP UDP Based Protocol Properties—General tab” on page 723
■
“Creating service groups” on page 183
■
“Service Group Properties—General tab” on page 726
■
“Service Group Properties—Protocols tab” on page 727
■
“Creating basic rules” on page 273
Using a forwarding filter to pass DNS traffic
For implementations that require fast throughput of DNS traffic, and when security is not the most
important issue, use a forwarding filter. Forwarding filters provide the most efficient solution because
a forwarding filter acts simply as a packet filter. There is no screening for RFC compliance. Therefore,
the target server must be hardened. As with the GSP, the security gateway is transparent for port 53
traffic, but unlike GSP, routes must function between source hosts.
This option creates a path for port 53 traffic between the two DNS servers, bypassing security checks
and logging. There are some important considerations when using this method:
■
Because the traffic is passed, no conflicts are created by leaving the DNS proxy enabled, which lets
the security gateway continue its normal functions. Features such as host names in log files, round
robin load sharing, spoof protection, and name based rules, continue to function.
■
Forward filters do not have the DNS proxy’s ability to screen and drop inappropriate DNS traffic.
Ensure that the destination host has been properly patched and hardened, especially if it is
publicly accessible.
■
Forwarding filters are used to pass UDP port 53 traffic directly to dedicated name servers, located
in a service network, from either public or internal hosts. Because traffic that passes through
forwarding filters maintains the original source IP address and source port, you must ensure that
proper routing methods are in place. You can use a TCP port between a client and server.
Apply To apply this change, and to continue adding or creating protocols for this service group, click Apply .
OK To apply this change, and exit out of this dialog box, click OK .
Close To exit out of this dialog box, and ignore changes, click Close .