Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an internal application sitting behind a firewall that has to FTP some files to uploads.google.com. I asked our network/sys admin to create a rule to allow it and they did, based on the IP of uploads.google.com.

However, Google change their IP address for this name from time to time and when they do, obviously the rule stops working.

I told them (admins) to use the name instead of the IP Address and they said that the performance hit on the firewall would be too big if it had to resolve names before allowing a package to go out.

I'm not an infrastructure guy, but I'm pretty sure that there is a way to cache the IP for a name for a certain amount of time to prevent from querying DNS all the time or something like that so: What options do I have to get pass this problem and still make them happy?

Thanks a lot

share|improve this question
    
They're playing you. 1) I'm sure they are using a local DNS server with caching. 2) How many hits per day/hour is that firewall rule really seeing?? It sounds like a one off firewall rule just for you. It shouldn't see that much traffic. Ask them for a hit count on the last 7 days. –  Aaron Copley Aug 19 '11 at 14:03

2 Answers 2

up vote 1 down vote accepted

Assuming that:

  1. The firewall has a DNS client that can resolve the name to the ip address

  2. That the aforementioned DNS client can cache the results of the DNS lookup

  3. That once the name is resolved and cached, subsequent packets are transmitted without having to resolve the name for every outbound packet until the TTL for the cached record expires, requiring a new lookup

I don't see how it can be that big of a performace load on the firewall (although you haven't stated what make/model firewall you're dealing with).

share|improve this answer
    
The network guys misunderstood(?) that this is for outgoing traffic. There shouldn't be FTP clients going wild inside the network. But from outside one could do FTP-connection-DOS because for every attempt (successful or not) there must be a rDNS lookup. –  mailq Aug 19 '11 at 14:06

Get the current of IP address for downloads.google.com, and add a static entry in you internal DNS. then you can always use the same IP to access google's service. Now the IP rotate for load balancing & other reasons, but you should be fine. You could get a list of a few of their IP's and have the FW admins add a few of them into the rules, then you'd just need to change the IP internally.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.