Forum Discussion

jmac's avatar
jmac
Icon for Making Connections rankMaking Connections
2 months ago

Endpoint Device DNS Resolution

When Cato is handling DHCP and DNS for all devices within an account across multiple vlans, across multiple sites, is it possible for a device to resolve the IP of a hostname outside of the local subnet that the device is on, using Cato DNS to resolve the hostname?

We historically have had on-prem Windows AD providing DHCP/DNS which reliably provided name resolution from hostname to IP, but also reverse DNS for IP back to hostname. We are moving to Entra ID/Intune+Auto Pilot managed devices with the outlook to retire our on-prem servers entirely.

We have various use cases where we need to resolve a hostname to have the IP returned, but also for the IP to resolve back to hostname via reverse DNS. This has become difficult for Entra ID managed devices unless the device is on the same local subnet where the site switch manages the resolution via the local mac table.

Is mDNS the right approach and where I should focus my attention or is there an alternative I should consider? As is looks like mDNS is restricted to vlans within the same site, it may not work in our scenario where we need to resolve across sites.

Any advice or recommendations are greatly appreciated.

network

5 Replies

  • jmac's avatar
    jmac
    Icon for Making Connections rankMaking Connections
    2 months ago

    I did see that and while it might operate across subnets within a site, it will not traverse sites and therefore won't meet my needs where I need to resolve hostnames across sites. I've also read it's a noisy protocol and could be detrimental to the stability of a network. Are there other options I haven't considered? How do others handle local dns resolution without an on-prem dns server?

    • michaelsaw's avatar
      michaelsaw
      Icon for Cato Professional Services rankCato Professional Services
      2 months ago

      Hi jmac, 

      Understood your requriements to resolve hostnames across sites. 
      Would you consider (1) hostname entries on local PCs or (2) internal DNS option?

      Cheers

      • jmac's avatar
        jmac
        Icon for Making Connections rankMaking Connections
        2 months ago

        Hi michaelsaw,

        Thank you for your reply.

        1) I'm not sure hostname entries on a local PC is a viable option with DHCP issuing new addresses all the time, how would that local file be reliably updated to be the same on all local PC's that need to match a hostname to IP for all the endpoints?

        2) We have an internal DNS server at the moment, from our legacy onprem domain, but the IP's are not being updated from the Cato DHCP service that's issuing the IP's. While I allowed insecure DNS updates temporarily, it didn't work and everything tells me this shouldn't be left as insecure so that config has been reverted.

        Is there a DNS Server config that Cato fully supports updating with the DHCP addresses it issues?