F5 FirePass, Руководство администратора

Страница: 31 / 182

Deploying the FirePass Server
FirePass
™
Server Administrator Guide 2 - 11
Understanding name resolution issues for FirePass
servers with a private IP address
If the FirePass server is installed on a corporate LAN or in a DMZ that uses
private IP addresses, the firewall or gateway performs Network Address
Translation (NAT). This means that the FirePass server has two different
DNS “identities”—one mapped to the public IP address, and another one to
the NAT'ed private IP address.
External users outside the firewall do not have name resolution problems
because the FirePass server’s name resolves to the public address of the
firewall or gateway. The firewall or gateway then forwards the user’s traffic
to the FirePass server.
However, internal users on the corporate LAN and the My Desktop client
software can be affected by internal name resolution problems unless you
prevent them. You can prevent name resolution problems by doing any of
the following:
◆
If you have an internal DNS server, set up a zone with a fully qualified
domain name (such as server-name.company.com), and then add an A
record to that zone that resolves to the FirePass server’s private address
(such as 10.0.0.8).
◆
If you have a WINS server, add a static entry for the FirePass server
name.
◆
If you have a firewall that supports a DNS alias feature (such as the
CISCO PIX), set up the firewall to redirect internal FirePass server
traffic originating from the corporate LAN to the FirePass server’s
private IP address.
◆
If there is no internal DNS server, WINS server, or suitable firewall, you
must use a local hosts file on each corporate LAN computer that must
connect to the FirePass server.
Note
This name resolution problem does not apply to a FirePass server that has a
public IP address because internal and external users can both use a name
that resolves to the same IP address for the server.
Important
To support the FirePass server’s application tunnels for clustered or load
balanced applications such as Oracle
®
, Citrix
®
, or SAP
®
, you must specify
the fully qualified domain names of the servers running the applications.
Those applications must also support the use of fully qualified domain
names when passing server address information to the client side
application. Single server applications may use the server IP address if the
remote client is also configured to do so.