topic Badly Explained ASA Question in Network Security

Badly Explained ASA Question

jdgriffiths — Mon, 11 Mar 2019 23:47:36 GMT

Hi there -

we have just installed a new ASA and its great except for one little issue. The outside interface IP address has a DNS name in the outside world of office.companyname.com - with our users connecting their IPhones etc to exchange via office.companyname.com/exchange - this all still works when they are outside the network, but from inside the network this server is no longer accessible. If I ping this name from the inside of the network, the IP is resolved but then the ping times out.

Any ideas??? Hope that makes sense......probably havent explained it too well!!

Badly Explained ASA Question

Marcin Latosiewicz — Wed, 29 Aug 2012 18:51:44 GMT

James,

If it's a problem of DNS you can have a look either into DNS doctoring (available on ASA) or setting up multiple zones (bind name) on your DNS.

I guess you would have expected office...../exchange to go to internal server?

Hard to say more without actual config - if in doubt you always have TAC 😉

Badly Explained ASA Question

Jon Eyes — Thu, 30 Aug 2012 04:28:43 GMT

Hi James,

Correct me if im wrong but the way i understand this in generality is your inside host/s is trying to connect to your firewall's outside interface/ip address.

By default ASA doesnt allow it. So you need to enable redirection/U-turning/Hairpinning

Badly Explained ASA Question

jdgriffiths — Mon, 03 Sep 2012 19:46:32 GMT

Thank you for the replies - we have an internal DNS server - all clients have this is their primary DNS. Would it be possible to create a "redirect" of some kind on the DNS to map requests for office.companyname.com/exchange to the internal name of the server, thus cutting the ASA out of the equation??? No idea how I would do this - not a server dude at all - any help would be appreciated!!!

Badly Explained ASA Question

lcambron — Mon, 03 Sep 2012 21:02:47 GMT

James,

I think you just need some NAT configuration.

Can you share your config and let us know the source IP address and the server's private IP?

Regards,

Felipe.

Badly Explained ASA Question

Jon Eyes — Mon, 03 Sep 2012 21:17:50 GMT

If we're talking a windows as a dns server here, just create a New Zone; Forward Lookup Zones > New Zone... default setting should work for most deployment, so i suggest keep the default. In your case, companyname.com. Then point that zone ip address to the internal address of that server. Create a New Host (A or AAA) under that newly created zone then point it to its corresponding ip address.

Badly Explained ASA Question

jdgriffiths — Mon, 10 Sep 2012 10:33:16 GMT

Thank you Jonjon - worked nicely thank you.