Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 1 reply
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 8325 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG DNS best practices with AD/DNS environment

VikenNajarian

 Hello,

I have read some KB and threads about DNS best practices for XG in an AD/DNS environment but they don't say all the same things...

In the most of the environment I manage for my custommers, there are AD/DNS servers and XG, actually the XG don't do any DNS resolution, I only use the AD/DNS servers to resolve internal and external domain names, configured like that:

AD/DNS server: 10.69.95.3

XG IP: 10.69.95.1

The AD/DNS server forwarders in the DNS service are 8.8.8.8 and 8.8.4.4.

actually the schema is : 

Client_PC ping internaldomain.local > AD/DNS resolves from his internal DNS Service > resolved

Client_PC ping externaldomain.com > AD/DNS resolves from 8.8.8.8 redirector > resolved

 

What is the best configuration to do in order to use XG in the DNS resolution process ?

 

Should I continue to use AD/DNS servers as only DNS on the client PC and add the XG's IP in the AD/DNS forwarders IP at the top, and add 8.8.8.8 and 8.8.4.4 in the DNS of the XG ?

Client_PC ping internaldomain.local > AD/DNS resolves from his internal DNS service > resolved

Client_PC ping externaldomain.com > AD/DNS redirects to XG > XG resolves from 8.8.8.8 > resolved

 

Or Should I use the XG's IP as the only DNS on the client PC and add a DNS request route for the internal domain on the XG, while still adding 8.8.8.8 and 8.8.4.4 in the DNS of the XG ?

Client_PC ping internaldomain.local > XG DNS request route redirects to AD/DNS > AD/DNS resolves from his internal DNS service > resolved

Client_PC ping externaldomain.com > XG resolves from 8.8.8.8 > resolved

 

Or should I simply let the actual configuration without any necessity to ask the XG to do DNS stuff.

What is the best way and the most secure way to use DNS in this environment?


Thank you for your help.



This thread was automatically locked due to age.
  • 0

    Hi,

    Would say - depends on your needs.

    There are couple of pros and cons of all DNS setups. 

     

    Some examples: 

    XG is DNS server for all clients : you will see ATP alerts of each client, who tries to reach a CNC server via DNS. 

    AD is DNS server for all clients : you will see the DNS as ATP source for the alert above. 

    AD has more features in the DNS (AD DC DNS features). 

    AD / XG is faster than XG / AD. (Depends on the hardware used for both...).

     

     

    Furthermore: most scenarios spit their network into different broadcast domains. Like LAN, DMZ, Server, etc. 

    In this scenario, it is common to use the XG as a DNS, because XG has a Interface in all networks.