Thread: DNS Doctoring
View Single Post
  #4 (permalink)  
Old 2007-09-28
mcnallym mcnallym is offline
Senior Member
 
Join Date: 2007-06-04
Posts: 983
Rep Power: 2
mcnallym has an average reputation (10+)
Default Re: DNS Doctoring

Check Point doesn't have a concept of DNS Doctoring as a Cisco PIX does as Check Point doesn't need to have the functionality.

Unlike the PIX there is nothing in Check Point to stop the internal network talking to the DMZ on the public nat address of the dmz server so there is no need to have DNS Doctoring in Check Point.

Unlike the PIX where the rules are written interface to interface, the Check Point merely uses src and dest IP address, and then uses the Anti-Spoofing config to determine if the src should be able to arrive on the interface.

ie

Internal Machine resolves www.mydomain.com as the public IP. traffic goes the gateway and matches the

src=any dst=webserver srv=htttp action accept

rule as the src matches the any and the webserver matches the public ip so check point sees as a valid traffic and allows through.

DNS proxy in ISP Redundancy is different to DNS Doctoring.
Reply With Quote