topic ASA DNS for inside clients? (ssl vpn from inside to ouside ip) in Network Security

ASA DNS for inside clients? (ssl vpn from inside to ouside ip)

alig.norbert — Mon, 11 Mar 2019 23:38:10 GMT

Hi there,

Wo got an ASA5510 (8.2x) with an inside, guest and outside interface.

On the guest interface, we have DHCP function on the ASA.

On the outside, there is web-ssl vpn (dns hostname on a public isp-dns server) configured.

When an user on the guest net tries to get connected with the web-ssl dns-name, it resolves the public, outside interface-ip , the ASA dropps it.

I know, with static NAT it can be resolved (http://m.techrepublic.com/blog/networking/cisco-asa-and-dns-pain-is-there-a-doctor-in-the-house/1140), but on

this scenario, we are trying to build a connection from a guest inside IP to the public-ip form the outside ASA interface.

If the guest users try an web-ssl connection on the guest-ASA IP, it works with a certificate error ( because there is no internal DNS on the guest net to resolve the dns name to the guest-interface IP).

So how can this be achieved? Can the ASA provide DNS server function? Can a NAT static entry (outside ip to interface guest) solve it?

It's the only solution an inhouse DNS server in the guest-net?

Thanks,

Norbert

ASA DNS for inside clients? (ssl vpn from inside to ouside ip)

Jennifer Halim — Sat, 04 Aug 2012 16:42:01 GMT

No, unfortunately you can't NAT the ASA interface IP Addresses, and also you can't connect cross interfaces, so if you are on the Guest network, you can't connect to the Outside interface.

ASA also does not provide DNS functionality as it is not a DNS server.

For guest users, they can only connect to othe Guest-ASA IP, and you would need to add the certificate to the CA Root certificate store on the PC and you won't get the error after adding those.

ASA DNS for inside clients? (ssl vpn from inside to ouside ip)

alig.norbert — Tue, 14 Aug 2012 12:00:36 GMT

Had to put a DNS (IOS Router) in the guest NAT.

For Cisco.

Such a service (DNS Server) should be supported on the ASA......

Greets,

Norbert