DNS resolver support?

[johnnyringo]

Pretty sure the answer is 'no', but does Checkpoint offer a DNS resolver service on their firewall/gateway products that I'm not aware of?   To be clear, I'm just talking a "forwarding" or "cache only" DNS server that can selectively forward certain queries to other internal DNS servers.  It does not need to be authoritative or even do recursive lookups.  

Palo Alto has offered this feature for at least 5 years called "DNS proxy", which is very useful for hybrid cloud scenarios where private DNS resolution is a requirement.  To my knowledge, the are the only vendor with a service like this.  

[the_rock]

I believe Cisco Umbrella is similar offering. To my knowledge, never heard of something like that on CP.

Andy

[the_rock]

Not sure if this might be it, will read up on it after

https://sc1.checkpoint.com/documents/SMB_R80.20/AdminGuides/Locally_Managed/EN/Content/Topics/Config....

[johnnyringo]

Huh interesting.  Seems like it would forward all DNS queries though, which in this specific case I want to avoid (i.e. i only want 'example.internal" to be forwarding to internal DNS servers, with all other queries going to the default DNS server.  

[the_rock]

Right...oddly enough, I could not find similar process for regular Gaia, so not sure it even exists, but maybe someone else can confirm.

Andy

[the_rock]

Quickly checked clish and I see below option, but dont believe this would help in your case either...?

Andy

quantum-firewall> set dns proxy forwarding-domain
DNS Forwarding Domains:
DNS queries in a forwarding domain can be forwarded to specific DNS servers.
A forwarding domain consists of a domain suffix and 3 DNS servers.
DNS queries ending with the domain's suffix will be forwarded to the domain's DNS servers.

quantum-firewall> set dns proxy forwarding-domain

[Wolfgang]

@the_rock the mentioned feature is possible with VSX and as I know not available in normal GAiA

Working with Virtual Systems chapter „configuring DNS server for a virtual system“

[the_rock]

Thanks for pointing that out @Wolfgang , good to know.

Andy

[emmap]

DNS forwarding is only supported on the Spark range. If you need it on Quantum, please raise an RFE.

[johnnyringo]

Or I could buy a Palo Alto and actually have the features I want right now.   

Just sayin'

[the_rock]

As I like to say...I dont disagree with you, meaning, I AGREE with you 😉

Andy

[PhoneBoy]

Gaia includes dnsmasq as part of the installation, which I believe can serve this function.
This is from a while ago, but it should still mostly be applicable.
See: https://phoneboy.org/2014/09/02/fun-with-check-point-dynamic-ip-gateways-in-r77-dot-20-with-gaia/ 

Note this is not formally supported.
If you require formal support, please raise an RFE with your local Check Point office. 

[Wolfgang]

This solution only works for embedded GAiA gateways. It's too mentioned by @KennyManrique in this older thread https://community.checkpoint.com/t5/SMB-Gateways-Spark/DNS-forwarding-for-internal-domain/m-p/69380#

Every year since the last 5 years I created a feature request for this. Maybe it will be available in the next decade...

[PhoneBoy]

I've used it on Gaia (not embedded) gateways and it works.
Granted, this wasn't recent, but I do see that dnsmasq is still present in R81.20 and have no reason to believe it wouldn't work with a similar configuration.

That's not the same as fully supported, of course (which requires an RFE).

[Wolfgang]

Available on „real“ GAiA, this sounds really good Dameon. Never checked this out.

[the_rock]

I did test this in my R81.20 lab and it did work. But, lets be honest here...if someone did it in production and it broke, TAC would never help them, as its not officially supported and as we all know, RFE can take weeks, months, years...maybe more, who knows.

[HeikoAnkenbrand]

Hi @johnnyringo,

DNS server is not supported on a GAIA gateway. RFE will take too long 🙂
But the following SK can help you. Maybe in your case it is possible to solve this via DNS NAT.

How to configure DNS NAT (sk34295) 

[the_rock]

Had customer who wanted to do this couple of years ago, we had TAC case going for 4 months, went nowhere, so client gave up on it. Not sure if anyone made it work before, but we must have spent at least 20-25 hours on the phone with support trying to make this work and nothing.

[N_Desrochers]

I use it on VSX in R81.10 and works

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_VSX_AdminGuide/Topics-VSXG/Working...