Dell Security Management Server and Dell Security Management Server Virtual Split DNS Recommendations

Sammendrag: Dell Data Security protected devices may reside at times internal to the network, and other times external to the network, it is recommended that administrators implement split DNS.

Denne artikkelen gjelder for Denne artikkelen gjelder ikke for Denne artikkelen er ikke knyttet til noe bestemt produkt. Det er ikke produktversjonene som identifiseres i denne artikkelen.
Ta en titt på andre ressurser

Symptomer

Affected Products:

  • Dell Security Management Server
  • Dell Security Management Server Virtual

Årsak

Not Applicable

Oppløsning

Split DNS is an approach where the protected endpoints are configured to connect to a single server alias name that resolves to different locations depending on where the name request is made. To configure the environment in this way, each server requires an SSL certificate with both the shared alias name and the server's name configured in the Subject Alternative Name (SAN) field. The SAN may contain the FQDN or hostname of all servers and aliases to reduce the number of certificates to manage.

Example:

  • Front-end server:
    • Internal name:
      • ddsfe.domain.com
    • IP:
      • 172.16.5.12
    • SAN names on certificate:
      • dds.domain2.com
      • ddsfe.domain.com
  • Back-end server:
    • Internal name:
      • ddsbe.domain.com
    • Alternate internal a-record:
      • dds.domain2.com
    • IP:
      • 172.16.5.10
    • SAN names on certificate:
      • dds.domain2.com
      • ddsbe.domain.com
  • Router:
    • Ports:
      • 8443, 8888, 8000, 8081 are pointing from external -> 172.16.5.12 (the front-end server)
  • Registrar:
    • External hostname:
      • dds.domain2.com - pointing to external IP

Clients are configured to with the dds.domain2.com alias, when installing Dell Data Security. When the device is internal to the network, the dds.domain2.com alias resolves to the back-end server. When external to the network, dds.domain2.com is routed to the external IP, hits the router, and any traffic coming from 8443, 8888, 8000, or 8081 is directed to 172.16.5.12, which is the front-end server. Since both servers have a validated name on their SSL certificate, the entire process is fully trusted.

For more information about network requirements, reference these following Knowledge Base articles:

To contact support, reference Dell Data Security International Support Phone Numbers.
Go to TechDirect to generate a technical support request online.
For additional insights and resources, join the Dell Security Community Forum.

Berørte produkter

Dell Encryption
Artikkelegenskaper
Artikkelnummer: 000129439
Artikkeltype: Solution
Sist endret: 11 apr. 2024
Versjon:  8
Få svar på spørsmålene dine fra andre Dell-brukere
Støttetjenester
Sjekk om enheten din er dekket av støttetjenestene.