Thread Info
  • State Suggested Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 56 replies
  • Answers 1 answer
  • Subscribers 12 subscribers
  • Views 379148 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[SOLVED]DNS best practice?

tbrandl

There are two ways to configure DNS:

One way:
- Allowing DNS outgoing for your internal nameservers
- internal nameservers forwarding to ISP-DNS
- ASG pointing to internal nameservers 

Another way:
- ASG forwarding to ISP-nameservers
- "request routing" on ASG for internal domain pointing to internal nameservers
- internal nameservers forwarding to ASG
 
Which way do you use? And why? Which is "officially preferred"?
Both configurations seem working good for me, we run the first alternative on our cluster, the second in branch offices without internal dns (domain dns reachable via site2site-vpn).

Thanks for your ideas!
Thomas



BAlfson's DNS Best Practice's post has been moved to it's own highlighted thread here: https://community.sophos.com/utm-firewall/f/recommended-reads/122972/dns-best-practice
[edited by: FloSupport at 11:12 AM (GMT -7) on 18 Sep 2020]
Parents
  • 0
    REQUEST ROUTING -> is empty

    So, we assume that there is no internal name server.

    but can't display it's webpages in FireFox

    What do you see in the Web Filtering log file when there's no display.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    So, we assume that there is no internal name server.


    Nope, there's nothing defined there, I couldn't figure out why I would need this, I read the help page about that :
    " this server could be used as an alternate server to resolve DNS queries for a domain you do not want to be resolved by DNS forwarders" 

    There are no names right now wich I want to resolve inside over going to the regular DNS forwarder,  
    what's the real use for that?

    What do you see in the Web Filtering log file when there's no display.


    Nothing Web filtering is OFF in the 'GLOBAL' tab.
Reply
  • 0 in reply to BAlfson
    So, we assume that there is no internal name server.


    Nope, there's nothing defined there, I couldn't figure out why I would need this, I read the help page about that :
    " this server could be used as an alternate server to resolve DNS queries for a domain you do not want to be resolved by DNS forwarders" 

    There are no names right now wich I want to resolve inside over going to the regular DNS forwarder,  
    what's the real use for that?

    What do you see in the Web Filtering log file when there's no display.


    Nothing Web filtering is OFF in the 'GLOBAL' tab.
Children
No Data
Unfiltered HTML