what is the concept of DNS-proxy?

[willstech]

Hi all.

I’d like to configure and know DNS proxy.

Domo customer wants to configure DNS proxy.

So I was read a PA 4.0 administration guide but I can’t understand completely.

What concept does DNS-proxy has??

is it mapped between internal DNS and external DNS?

If I will make a DNS-proxy rule, is it possible to connect internet with internal DNS server?

When do I use the DNS-proxy?

The customer has internal DNS Server but this server can’t connect to external network including public DNS Server because of security issue.

So this internal DNS cannot update DNS information due to network communication problem.

Clients must use internal DNS for internal communication.

is DNS-proxy appropriate way to communication with Internet, at this environment?

Please explain me how to configure DNS proxy, If it is appropriate way.

Administration guide is not enough to understand.

Thanks and regards,

Eugene.

[reaper]

Hi Eugene

the DNS proxy is a stub resolver, this means it can receive and forward DNS queries to other (authoritative or recursive) DNS servers but can't act on its own.

it enables you to reroute requests for certain zones to a DNS server of your choosing, and forward everything else to a different DNS

a good example would be servers in a DMZ that need to know certain internal zones, but you don't want them accessing the internal DNS server directly.

if you setup a DNS proxy that reroutes for example localzone.local to your internal DNS server, and forwards everything else to the external DNS, you make sure other zone information on your internal DNS servers is kept secret from the DMZ servers.

it can also be set up to connect internal DNS servers with external ones, if you don't want them directly connecting to eachother, or if the internal DNS servers are not allowed outside of the network, as in your example

regards

[bwaaso]

I used the DNS proxy so my internal Windows DNS servers only communicate with the Palo Alto DNS Proxy and not directly with Internet DNS servers.

Setup DNS Proxy with a primary and secondary iInternet DNS server.

Setup security rule allowing DNS to trusted interface and out untrusted.

Windows DNS forwarded to trusted interface.

Windows DNS checked do not use recusion for this domain.

[brancwa]

How does this work with NAT?  Does this feature work like the Ciso DNS rewrite?

Thank you,

Wallace

[reaper]

the DNS proxy will behave like service routes: it will use the interface IP of it's eggress interface as source IP and the VR as routing table