Multiple DMZ's and DNS Servers

[b.joanis]

We recently went froma single port PIX to a multiple port and DMZ setup. I am trying to figure out the best way from a topology setup to place DNS servers with in this design. Would one place a DNS server in each zone and perform zone transfers or would a single DNS server located in one DMZ work. A concern I have with the single DNS server would be extra latency and processing on the PIX.

Thanks,

Brian

[nkhawaja]

Hi,

Best is to have two separate DNS servers, one Public accessible (in DMZ) and other for your private network (in Inside). Zone Transfer should not be done between the two if one is for public address and one for private addresses.

You can also have only one DNS server on the DMZ. Or one in the DMZ and one inside, doing Zone transfer.

But you need to tell who these DNS Servers will be serving?

Thanks

Nadeem

[b.joanis]

Nadeem,

We are actually running a total of four DMZ's, design is modeled after the SAFE design. One DMZ is configured for Web servers ect (public access), another for application/Database servers, the third is an old legacy DMZ that provide's a seperate campus network that we attach workstations on for interent access and the fourth is the Campus connection.

So from what I gathered from your response and the other individuals it would be best to treat each DMZ as a seperate network with it's own associated DNS server. This would provide the best security and scalability.

Thanks,

Brian

[b.joanis]

We are actually running a total of four DMZ's, design is modeled after the SAFE design. One DMZ is configured for Web servers ect (public access), another for application/Database servers, the third is an old legacy DMZ that provide's a seperate campus network that we attach workstations on for interent access and the fourth is the Campus connection.

So from what I gathered from your response and the other individuals it would be best to treat each DMZ as a seperate network with it's own associated DNS server. This would provide the best security and scalability.

What is the best way to provide DNS information across zones??

Thanks,

Brian

[nkhawaja]

Hi,

It does not matter how many DMZs you have, bascially your DNS servers should be separated into two parts

1- serving for private IPs for your internal network

2- Serving for public IPs for internal+external network.

Thanks

[b.joanis]

Hello,

Thank you, that is what I though now I have to convince the executive group. That is a little more complicated then the technology itself, sorta the layer 8 in the OSI model.

[lwierenga]

Nadeem is exactly correct. Also, there will not be any latency/impact on your PIX.