About EDSAadmin

Currently i two AD dns zones in on my DNS server (windows): mycompanydom.com - internal domain mycompanyplan.com - external domain where all our internet webservers and web applications live. my A records in mycompanyplan.com point to internal non routable IPaddress for each internal server so the traffic does not go out the firewall and back in.  We also have 3 IPSEC VPN tunnels where the dns zone information is replicated to. My problem that i run into is if a tunnel goes down then my users in those sites cannot get to the services they need because their dns query is resolving to a non routable internal IP and trying to go down the tunnel vs resolving to the external IP. I would like to remove that zone completely  from my DNS infrastructure and that way all dns queries to mycompanyplan.com resolve to the external IP's instead. My 3 satellite offices would route out their firewall to the external IP vs currently routing down the vpn tunnels.  Is there a way to configure the PAN3020's in my HQ where all of my inbound web services reside to see the traffic and have it loop back without having to go out the external interfaces only to come back in? Not sure if i am making sense while writing this, so if you need clarification please let me know.  Maybe a another way to say this is, if a company has inbound web servers how is everyone setting up DNS and routing traffic when those web servers are in the same office but have need to be accessible externally? Is there a way to prevent that traffic from leaving the firewall only to come back in? ... View more

On our firewall we have some inbound web servers with static NAT policies using SNAT and others inbound web servers/services with DNAT policies.  I am trying to figure out which one i should be using.  For example the company we hired to implement our firewalls and setup policies use the SNAT way for every Static NAT policy. When I called into support for an issue one time, they stated that i should be using DNAT and not SNAT. ... View more