Internet/WAN & DNS
6. Internet and WAN Standards
WAN services must be sized for business traffic, support stable outbound cloud access, and fail over without changing security posture. The backup path must use the same DNS, NTP, TLS, and firewall outcomes as the primary path.
| WAN area | Requirement | Acceptance check |
|---|---|---|
| Primary circuit | Reliable business-grade access with sufficient bandwidth | Speed, latency, and loss sample during peak window |
| Backup circuit | Independent path where feasible | Controlled failover test |
| Routing | Consistent path to required PAR and third-party destinations | Route and policy review |
| DNS | Same resolver behavior during failover | Resolution test on primary and backup |
| NTP | Time sync remains available during failover | NTP query test on primary and backup |
| TLS | No certificate validation breakage during failover | HTTPS test to required destinations |
7. DNS Requirements
POS endpoints and local services must be able to resolve PAR, Brink, AWS, Remote Care, processor, and approved third-party integration names. DNS blocking, rewriting, or filtering must not alter required service behavior.
| DNS control | Requirement | Implementation example |
|---|---|---|
| Resolvers | Use reliable customer-approved resolvers | Internal DNS forwarding to trusted public or enterprise resolvers |
| FQDN policy | Support wildcard and dynamic updates | *.parpos.com and *.brinkpos.net as named policy objects |
| Filtering | Do not block required service categories | Allow approved POS, cloud, support, and payment dependencies |
| Logging | Retain query logs where feasible | Resolver or firewall DNS log export |
7.1 DNS Implementation Examples
| Scenario | Recommended approach | Avoid |
|---|---|---|
| Enterprise DNS | Forward required external names normally and preserve TTL behavior. | Static host overrides unless approved. |
| Firewall DNS proxy | Ensure proxy resolves wildcard policy objects and refreshes dynamic IPs. | Stale FQDN caches. |
| Guest DNS | Keep guest resolvers separate from POS resolver path. | Guest DNS routes into POS VLAN. |