topic DNS Rewrite / Redirect in Network Security

DNS Rewrite / Redirect

Roger Base — Tue, 12 Mar 2019 04:37:00 GMT

Hi There.

I want to achieve DNS rewrite for my users at the inside interface (192.168.0.1/24). So when they to reach www.myactivedirectory.com 7.7.7.7 (on the mypages interface) the ASA should translate/rewrite 7.7.7.7 (orginal request) into 8.8.8.8 (on the tmg interface).

How can solve this ? The alias commands dosent work anymore.

ASA 8.2(4)

Hi, Can you explain bit more

nkarthikeyan — Wed, 13 Aug 2014 12:25:20 GMT

Hi,

Can you explain bit more on your query?

say if a user 192.168.0.100 from inside if he tried to access a URL www.myactivedirectory.com (7.7.7.7) asa should redirect the user to 8.8.8.8 instead of the original destination ip right?

or you want to issue the private or real ip of the server instead of the public ip?

Regards

Karthik

Sorry for the confusion.When

Roger Base — Wed, 13 Aug 2014 12:45:33 GMT

Sorry for the confusion.

When you are on the Testusers subnet you will access http://mypage.local with dns record of 172.17.212.20 (servers subnet) (I wanna rewrite that record with 192.168.8.10 on my ASA Hotspot subnet.)

But the rule I wrote dosent seem to affect that.

static (Servers,Testusers) 192.168.8.10 172.17.212.20 netmask 255.255.255.255 dns
static (Testusers,Servers) 192.168.8.10 172.17.212.20 netmask 255.255.255.255 dns

DNS inspection is ON

interface GigabitEthernet0/2.8
nameif Hotspost
security-level 65
ip address 192.168.8.1 255.255.255.0
!
interface GigabitEthernet0/2.212
nameif Servers
security-level 75
ip address 172.17.212.1 255.255.255.0
!
interface GigabitEthernet0/2.74
nameif Testusers
security-level 40
ip address 172.17.74.1 255.255.255.0
!

Hi, Using 192.168.8.10 (

nkarthikeyan — Wed, 13 Aug 2014 13:02:39 GMT

Hi,

Using 192.168.8.10 ( which belongs to hotspot interface range) is quite improper here in this case.... we need to do a different method, let me check if that can be done possibly.

Regards

Karthik

It should be possible to this

Roger Base — Wed, 13 Aug 2014 13:34:06 GMT

It should be possible to this on 3 diffrent interfaces.