topic Content Rule-Based DNS in Application Networking

Content Rule-Based DNS

subhash — Wed, 27 Apr 2005 15:27:14 GMT

We have configured the CSS for content rule-based DNS operation for GSLB. The CSS are installed behind a firewall. CSS are configured with private addresses for the services and the VIP. This VIP is translated at the firewall for external access.

In this scenarion, when the CSS receives a DNS query it returns the VIP (private address) and hence the clients can't reach. How can I change it to retun the public address to the user.

Re: Content Rule-Based DNS

Gilles Dufour — Thu, 28 Apr 2005 08:44:46 GMT

the firewall needs to inspect the dns response and nat the private address into public address.

This is called dns doctoring and can be done on a Cisco pix firewall with the command 'alias'.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094aee.shtml

Regards,

Gilles.

Re: Content Rule-Based DNS

subhash — Fri, 29 Apr 2005 07:37:53 GMT

Thank you Gilles. I knew the dns doctoring. I wanted to know if there is any workaround within CSS. Thank you for the confirmation.

Re: Content Rule-Based DNS

Gilles Dufour — Fri, 29 Apr 2005 10:53:46 GMT

you can configure the CSS to return the public ip address.

But internal users that may require to use the private ip address will also receive the public ip address.

To configure the CSS, you need to use dns a-record and therefore use dns zone-based solution instead of rule-based.

http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_configuration_guide_chapter09186a00801eebaa.html

Regards,

Gilles.