topic Re: dns on pix in Network Security

dns on pix

rpalacio — Fri, 21 Feb 2020 08:32:19 GMT

dns_inside----pix-----user

dns is at the inside subnet

user is on the dmz

domain controller on the inside subnet

observations;

1. with nat (inside) 0 0 , the user could logon to the domain, but couldnt brouse any machine on the inside.

2. with nat (inside) 1 0 0 , user couldnt logon to the domain controller. static command is invoke with the ff detail

static (inside, dmz) 10.2.2.10 10.1.1.10

10.1.1.10 is the dns

10.2.2.10 is the outside mapped ip

ping from user to 10.2.2.10 is ok.

10.2.2.10 is configured as dns on windows user.

why cant i have dns service if am using nat?

Without nat, why cant i browse the inside network? i could find a computer on the inside using the computer name, thus dns is doing his job. I just cant browse.

anyone here could help me pls..

thanks a lot.

Re: dns on pix

nkhawaja — Sat, 19 Nov 2005 19:28:53 GMT

hi,

the rule of translation requies you to have static translation if you want connection from dmz to inside.

so you have to use static translation or nat 0 with access-list

thanks

Nadeem

Re: dns on pix

rpalacio — Sat, 19 Nov 2005 20:22:07 GMT

ive done that, thats why i was able to login to the domain controller inside from a user on the DMZ.

Re: dns on pix

nkhawaja — Sun, 20 Nov 2005 13:55:05 GMT

so what is your question/issue?

Re: dns on pix

rpalacio — Sun, 20 Nov 2005 20:20:35 GMT

the issue is i cant browse the inside network from the dmz...

inside is where servers are.

dmz is where users are.

Re: dns on pix

nkhawaja — Mon, 21 Nov 2005 00:09:18 GMT

browsing the servers means? you cant connect via http or via windows network share etc.

in either case, you need to have an Access-list applied on the dmz interface to allow the desired traffic to reach the inside from dmz

Re: dns on pix

rpalacio — Mon, 21 Nov 2005 04:09:04 GMT

i cant see any macine on the inside from the network neighborhood. But if i do a search on the machine thru their computer names, it works.

Re: dns on pix

nkhawaja — Mon, 21 Nov 2005 21:33:25 GMT

may be it requires WINS setting. or the necessary ports to be opened.

Re: dns on pix

rpalacio — Tue, 22 Nov 2005 07:15:11 GMT

hello,

It was able to browse the network even by just having a DNS. Server IPs must not be translated between inside and dmz though i still have to invoke the static command.

I dont know but its just taking a lot of time to for the pix to discover the network.