O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

6.7. Configure the DNS Proxy for Split DNS

Problem

You need to provide internal DNS servers for internal resolution, and public servers for external resolution.

Solution

Configure the DNS proxy:

	FIREWALL-A-> set dns proxy
	FIREWALL-A-> set dns proxy enable
	FIREWALL-A-> set interface wireless1 proxy dns
	FIREWALL-A-> set dns server-select domain juniper.net primary-server
	    10.1.1.1
	FIREWALL-A->set dns server-select domain * primary-server
	    68.87.64.146 secondary-server 68.87.75.194

Discussion

You can use the DNS proxy functionality in ScreenOS to enable split DNS. Figure 6-2 shows a typical DNS proxy solution.

Figure 6-2 illustrates a traditional Small Office/Home Office (SOHO)environment. A firewall is deployed in the remote office, and an IPSec tunnel is built to headquarters. The administrators have deployed a "split tunneling" environment in which all traffic bound for corporate headquarters is sent to the IPSec tunnel, whereas external traffic is sent directly to the Internet Service Provider (ISP).

The need for "split DNS" arises for internal hosts that resolve to private addresses (that cannot be resolved publicly or that resolve to different addresses if they are using private DNS versus public DNS). When the DNS proxy is enabled on an interface, the firewall will act as the DNS resolver for the clients. You can use either static configuration on the client or DHCP to assign the firewall as the client DNS server.

Figure 6-2. A typical DNS proxy example

When a client needs to do a DNS ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required