Re: Changing IP addresses

re: the Cisco ASA anD DNS. I don't think you want DNS in that for a couple reasons.

1) Performance. Adding an NS query to every inbound packet would C-L-O-B-B-E-R performance. It would also hammer your DNS server.

2) DNS isn't perfect either. If someone poisons a DNS server and gets it to report a different address then they've just compromised your firewall. You don't want something OUTSIDE your organization able to influence the data allowed to pass through your firewall.


- Larry "DrFranken" Bolhuis

www.Frankeni.com
www.iDevCloud.com - Personal Development IBM i timeshare service.
www.iInTheCloud.com - Commercial IBM i Cloud Hosting.

On 9/22/2016 4:19 PM, Chris Bipes wrote:

The internet GURU's invented this thing called DNS. Yet most firewalls use IP addresses for allowing traffic, (Wish cisco would let me use URL's and perform DNS lookups.) So yes I agree that outside business partners may have opened secure ports for you to communicate with. This is only an issue if your public IP address is changing or if you have some sort of private MPLS thing in place.

Most mail servers can use and should be configured with full names such as mail.abc.com in the allow relay or white lists. (I dislike giving my public IP address as it can change at any time (we just changed ISP)).

All internal should be using DNS and NOT IP addresses. But then Exchange uses IP address for allow relay and not URL. (Come on Microsoft fix that.)

Ok done venting. But really software developers should be performing reverse lookups to see if the connection should be allowed. All of the domain managers should be making sure their reverse DNS is kept up. Live would be much easier to change IP schemes that way.

--
Chris Bipes
Director of Information Services
CrossCheck, Inc.

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Marc Rauzier
Sent: Thursday, September 22, 2016 12:20 PM
To: midrange-l@xxxxxxxxxxxx
Subject: Re: Changing IP addresses

Le 22/09/2016 à 20:49, Rob Berendt a écrit :

Once again we will be going through another round of changing IP
addresses. So, if any of you are doing a data center move, have the
network guy from hell dusting the shelf again, or whatever and are going
through this process I'd appreciate it if you'd share your experiences at
this site:
http://wiki.midrange.com/index.php/Change_IP_Address

Even if the update is to be done into a partner configuration not on
your server, you may want to add the following:

your IP address may exist in some authorization list in outside
firewalls or mail relays