topic DNS Rewrite on ASA 5510 in Network Security

DNS Rewrite on ASA 5510

John Woods — Tue, 12 Mar 2019 05:11:14 GMT

We have a guest wireless network configured that grants internet access only to users. The guest traffic is coming from a port on our 5508 WLC directly to the "guest" interface on our ASA 5510 (security level 50). The clients get DHCP from the WLC and DNS from external (ISP) DNS servers. Everything works great with one exception. We host our company website on the internal network ("inside" interface - security level 100). We need our guests to be able to access this internal web server.

After doing some research, it looks like I can accomplish this with DNS rewrite.

I would greatly appreciate configurations recommendations and command syntax for both the NAT command and ACL entry.

Thank you,

John

Hi,Let me assume these

Vibhor Amrodia — Fri, 05 Dec 2014 14:58:04 GMT

Hi,

Let me assume these parameters to describe this for you :-

Web server(inside):- 10.2.2.3

Users:- DMZ[172.16.0.0/24]

Natted IP for Web Server:- 2.2.2.2

You simply need to use this NAT statement:-

object network DMZ-Inside

host 10.2.2.3

nat (DMZ,inside) static 2.2.2.2

Access list should allow the traffic to the private IP from the DMZ inbound to inside interface.

Thanks and Regards,

Vibhor Amrodia

Well, the short version for

Marius Gunnerud — Fri, 05 Dec 2014 21:45:50 GMT

Well, the short version for configuring DNS rewrite for the webserver is to add the DNS keyword to the end of the existing NAT statement for that webserver.

You will then need to also allow traffic from the wireless clients to the webserver private IP on the ASA guest interface.

Please remember to select a correct answer and rate helpful posts

Hi,Also , if you use the "DNS

Vibhor Amrodia — Sat, 06 Dec 2014 06:04:35 GMT

Hi,

Also , if you use the "DNS" keyword on the ASA with the STatic NAT , you need to make sure that the DNS queries actually go through the ASA device and it will not work if you have an internal DNS server defined on the clients on the same subnet or behind the same interface.

Thanks and Regards,

Vibhor Amrodia