[FW-1] DNS implied rule - best practice

[Clive Luk [Permanent Link]]

Hi all,

I just got one question.

Is that a best practice to leave/allow the implied rule for DNS traffic
going from any to any? Is that vulnerable?

Should I just setup my own policy to allow DNS traffic accordingly? If I am
going to setup my own policy would that affect the performance on the FW? Is
there any other trade off by doing that?


Thanks!
Clive

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to LISTSERV AT amadeus.us.checkpoint DOT com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner AT ts.checkpoint DOT com
=================================================