DNS Doctoring

[vadi_ag]

Hi All ,
In PIX we have an option of alias for DNS doctoring do we have any similar options in checkpoint ??


Regards
Vadiraj

[Robby Cauwerts]

As far as I know: NO
I would be better if you explain in detail what you're trying to achieve.
(eg: you might use dns doctoring on Cisco vs the build in dns functionality on CP when you use ISP redundancy)

[vadi_ag]

I was tryig to understand the concept of DNS doctoring on CP
if u have any doc pls let me know

thnx

[mcnallym]

Check Point doesn't have a concept of DNS Doctoring as a Cisco PIX does as Check Point doesn't need to have the functionality.

Unlike the PIX there is nothing in Check Point to stop the internal network talking to the DMZ on the public nat address of the dmz server so there is no need to have DNS Doctoring in Check Point.

Unlike the PIX where the rules are written interface to interface, the Check Point merely uses src and dest IP address, and then uses the Anti-Spoofing config to determine if the src should be able to arrive on the interface.

ie

Internal Machine resolves www.mydomain.com as the public IP. traffic goes the gateway and matches the

src=any dst=webserver srv=htttp action accept

rule as the src matches the any and the webserver matches the public ip so check point sees as a valid traffic and allows through.

DNS proxy in ISP Redundancy is different to DNS Doctoring.

[cciesec2006]

As someone who have been working with Cisco Pix/ASA for the past
eight years, I can tell you that Pix/ASA is a piece of sh_t. Checkpoint
is much superior when it comes to setting up rule, NAT, etc.

For example, with Checkpoint, you have host A = 10.1.1.1/24 and
host B= 10.1.1.2/24 and they are static NATted by Checkpoint to
4.1.1.1 and 4.1.1.2, repsectively. Host A CAN talk to host B via 4.1.1.1
and 4.1.1.2 IP address. There is NO way that Cisco Pix can do this,
two hosts on the same network communicating with each other via
static NATted ip address.

The stupid Pix/ASA limitations come from the security level. It is a pain
in the ass and causes lot headaches for everyone.

You do not need DNS doctoring (alias or whatever cisco calls it now) in
Checkpoint.

my 2c.