Screen OS

We have SSG-140 acting as DHCP server for local networks. We are using ISP DNS setings. We have request to block all P2P traffic. I know that we need IDP for this, but for now we will try OpenDNS. We want to prevent users to stay blocked even if they change dns on their machines (they all have admin privileges).
So the question is how to forward all traffic from LAN on port 53 to OpenDNS on SSG-140 firewall.
Is anybody have some experience how many users can OpenDNS serve without slowing down the internet.

Thanks.

On sites using opendns we create two policies to enforce the use of these servers.

1- from trust to untrust permit dns to the opendns servers

2- from trust to untrust deny dns to any address

This pair allows the requests to the right servers first and then any other use of dns from the client zone is blocked.

Thanks. I will try this.

Hello Spuluka

Can you tell me in which part of my configuration I should permit dns to the opendns servers in a Junos SRX100?

set security policies from-zone trust to-zone untrust policy Internet match source-address any
set security policies from-zone trust to-zone untrust policy Internet match destination-address any
set security policies from-zone trust to-zone untrust policy Internet match application " "
set security policies from-zone trust to-zone untrust policy Internet then permit

set security policies from-zone trust to-zone untrust policy Block-DNS match source-address any
set security policies from-zone trust to-zone untrust policy Block-DNS match destination-address any
set security policies from-zone trust to-zone untrust policy Block-DNS match application any
set security policies from-zone trust to-zone untrust policy Block-DNS then deny

Regards.

Hi Aaron,

I would suggest modifying the first policy destination from 'Any' to 'IP of Open DNS' and application to DNS.

Please post the query in SRX (http://forums.juniper.net/t5/SRX-Services-Gateway/bd-p/srx) section for expert comments.

In the permit rule you will set the destination address to be the ip addresses of the open dns servers.

In both rules you will set the application to be dns.

Thank you Guys