Symantec™ Security Gateways Reference Guide - Sawmill

Understanding accessProxies53The proper way to configure the DNS proxy to use internal name servers is to delegate through the DNSproxy’s zone files. For example, let’s define 192.168.1.10 and 192.168.1.20 as our internal name servers,and let’s say that they are authoritative for three zones:myco.orgForward zone for myco.org1.168.192.in-addr.arpa Inverse lookup table for zone 192.168.1.0/2416.172.in-addr.arpa Inverse lookup table for 172.16.0.0/16You set up the DNS proxy’s private zone file to delegate to the internal name servers for any of the above.You start with six entries:■■■■■■192.168.1.10 ns1.myco.org #nsfor myco.org192.168.1.10 ns1.myco.org #nsfor 1.168.192.in-addr.arpa192.168.1.10 ns1.myco.org #nsfor 16.172.in-addr.arpa192.168.1.20 ns2.myco.org #nsfor myco.org192.168.1.20 ns2.myco.org #nsfor 1.168.192.in-addr.arpa192.168.1.20 ns2.myco.org #nsfor 16.172.in-addr.arpaThis pre-populates DNSd’s cache with the following information:; delegation NS recordsmyco.org.IN NS ns1.myco.org.IN NS ns2.myco.org.1.168.192.in-addr.arpa.IN NS ns1.myco.org.IN NS ns2.myco.org.16.172.in-addr.arpa.IN NS ns1.myco.org.IN NS ns2.myco.org.Now, when a name in any of the three zones is sought, the resolver queries the DNS proxy cache. The DNSproxy then does one of the following:■■If the DNS proxy has resolved the query once before, it doesn’t have to burden the internal nameservers with a redundant query. The current information is pulled from the DNS proxy’s cache.If there is no record in cache, the DNS proxy looks up the authoritative name servers for the zone. Fromthe records above, the DNS proxy knows where to send the request. Unlike a resolver, though, the DNSproxy is a bit smarter. It first checks round-trip times (RTT) of queries to the name servers, and uses theone with the best response. This contributes to name lookup efficiency and load balancing.The FTP proxyThe file transfer protocol (FTP) is commonly used to transfer files from one location to another. FTPnormally works through a pair of connections between a client and a server. The FTP proxy supports theFTP protocol, and lets the administrator refine connections to allow both PUT and GET commands(default), PUT commands only, or GET commands only.The FTP proxy is configurable to block connections based on length of user names and passwords. Thedefault is 32 characters for both user name and password, with the maximum being 256 characters. Thisfeature provides protection against user name/password buffer overflow attacks. The default logon banner,Secure Gateway FTP Server, can also be changed to minimize the risk of identifying the security gateway’spresence.