I'm running a Ironport WSA in transparent mode.
In advanced proxy config - DNS Options I find the following:
Find web server by: Specify how the appliance should find the location of the requested web server. 0 = use DNS answers in order 1 = use client supplied address then DNS 2 = use ONLY client supplied address 3 = use client supplied address for next hop connection and Web Reputation (Warning: Destination IP based policies will still use DNS). Default Value: 1
Can anyone explain why it makes sense to use 1 as the default?
With 1. a user can edit his hostfile and point www.google.com to 22.214.171.124. The request goes to the proxy, which does a dns lookup for www.google.com, but will still forward the request to 126.96.36.199.
Why is the proxy doing a dns lookup, if it doesn't use the answer?
Can anyone see a good reason not to use 0?
It makes sense to me, since the proxy does a DNS request anyway, and this will make the proxy logs more trustworthy.