Using external DNS security services with Checkpoint firewall

[MartinZ]

sk131852 makes note when using updatable objects that:

“To work well, the DNS set on the gateways must be the same as that used by the endpoints. Otherwise, the IP-domain mapping will not match.”

We can confirm when the Checkpoint gateways are on different DNS from the endpoints, use of updatable objects can break.

In our environment all endpoints point to a service like Cisco Umbrella. The Checkpoint gateways points to the ISP DNS.

We had concerns about pointing the gateways to a DNS security service because:

• Some bad traffic resolves will return the DNS service sinkhole and potentially mask an issue.
• The DNS service will have reporting, but backtracking will be painful.
• Might this break the Anti-bot blade and alerts in some cases.
• Can this impact other Checkpoint services?

We know updatable objects can break if the gateways and endpoints are not resolving to the same source. What can break if they are (and the source is a DNS security service like OpenDNS)?

[Sorin_Gogean · Accepted solution]

Hey,

On our whole environment we use Umbrella DNS and we didn't had any issues with CheckPoint FQDN objects.

Whatever Umbrella DNS doesn't catch, CheckPoint will do.

Still CheckPoint will see the DNS requests if the GW is in path for all clients - not sure how you are set.

Thank you,