topic Firewall & DNS Records in Network Security

Firewall & DNS Records

Ahmad Khalifa — Tue, 12 Mar 2019 03:21:49 GMT

I have this Senario as in attatchemnt

i have WEB Server into the Inside Network is NAT to Outside

when a client in the Outside Trying to Use the Resolved IP from the DNS the DNS reply by the IP that on the Inside for the Server itself before NAT

Any Idea to prevent the ASA5510 to Send the Inside IP tp the Outside DNS???

Firewall & DNS Records

Mariusz Bochen — Fri, 27 Dec 2013 11:46:17 GMT

Hi Ahmad,

If you have static NAT translating outside IP to the inside one ASA will not send inside IP to the outside DNS.

But this is not very clear and I am not sure if I properly understood your post, so can you include your NAT config please?

Regards

Mariusz

Firewall & DNS Records

Karsten Iwen — Fri, 27 Dec 2013 12:34:19 GMT

There is no communication between the ASA and the DNS-server. So the ASA doesn't send anthing to the DNS.

Regarding to your diagram, the DNS-server has a mapping to the internal address. A public DNS should always be configured with the public IP which would be 192.168.100.200 in your case. With that, the outside client would resolve the name to the right IP.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Firewall & DNS Records

Ahmad Khalifa — Fri, 27 Dec 2013 12:43:38 GMT

Hello

thank you for your Concern

when i run NSLOOKUP from the Client on the OutSide with the name of the WEB Server its Reply by the Internal IP Before NAT (LOCAL IP)

its Happen With me in 2 Different Sites

Firewall & DNS Records

Ahmad Khalifa — Mon, 30 Dec 2013 16:54:20 GMT

but its happen when you run cmd "nslookup" its reply by intenal IP noth the Global IP any idea

Firewall & DNS Records

Karsten Iwen — Mon, 30 Dec 2013 17:03:40 GMT

You have to correct that on the DNS-server. There the public IP should be configured.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Firewall & DNS Records

Ahmad Khalifa — Mon, 30 Dec 2013 17:33:36 GMT

this is what i use to do each time

Firewall & DNS Records

Karsten Iwen — Mon, 30 Dec 2013 18:13:48 GMT

What do you mean with "each time"? Is your change not permanent? What kind of DNS-server is it?

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni