topic DNS internal ASA5500 in Network Security

DNS internal ASA5500

MaDe — Tue, 12 Mar 2019 00:56:26 GMT

Good day all,

short question....
I setup a new ASA for our branch office everything is working fine. But I have a little problem with the ASA.
I try to configure that my ASA in the branch office can resolve internal host to IP. Problem is that our internal DNS servers located in a different location and DNS is working over a VPN. This is working for the branch office client but not for the ASA.

Have somone an Idea or is it by design....?

Thanks Markus

DNS internal ASA5500

Jennifer Halim — Wed, 06 Feb 2013 05:24:53 GMT

The reason why it's not working is most probably because the ASA route the dns packet via its outside interface, hence the source IP is the ASA outside interface, while your VPN crypto ACL does not include the ASA outside interface, hence it's failing via the VPN.

To fix the issue, you can include the branch office ASA outside interface into the crypto ACL as the source ip towards the remote LAN, and mirror image ACL on the remote crypto ACL as well.

You would also need to configure NAT exemption on the remote server to NAT exemption between the remote LAN towards the branch office ASA outside interface.

Hope that helps.

DNS internal ASA5500

MaDe — Wed, 06 Feb 2013 14:56:00 GMT

Hi Jennifer,

thanks for your response. So for beginners.... I have to create the crypto like this scheme

branch_asa crypto acl
src: 192.168.0.0 --- dst: 192.168.1.0

src: 1.1.1.1

remote_asa crypto acl

src: 192.168.1.0 --- dst: 192.168.0.0

src: 2.2.2.2

Thanks,

Markus

DNS internal ASA5500

Jennifer Halim — Thu, 07 Feb 2013 01:58:02 GMT

Example:

if your branch ASA outside interface is 1.1.1.1, and the remote LAN is 192.168.1.0/24, then:

branch ASA:

crypto ACL: permit ip host 1.1.1.1 192.168.1.0 255.255.255.0

remote ASA:

crypto ACL: permit ip 192.168.1.0 255.255.255.0 host 1.1.1.1

the above is in addition to crypto ACL that you already have in place.

And on the remote ASA:

your NAT exempt will be the same as your crypto ACL

DNS internal ASA5500

MaDe — Thu, 07 Feb 2013 10:48:56 GMT

Hi,

perfect. That is working.

Thanks Markus

DNS internal ASA5500

Jennifer Halim — Thu, 07 Feb 2013 11:59:43 GMT

Excellent, thanks for the update.