topic Re: PIX DNS resolution issue in Network Security

PIX DNS resolution issue

sanjay.sangwan — Fri, 21 Feb 2020 08:11:25 GMT

HI,

I am trying to login to active directory server on inside from an outside of a PIX.The server works as DNS also.Follwing IP address is mapped

static(inside,outside) 192.168.2.90 192.168.1.90

AD Server(DNS)= 192.168.1.90

When I am trying to access the DNS from outside on 192.168.2.90 , The internal DNS replies with the 192.168.1.90 as AD domain name and login fails.How can I get the NATED IP as the Domain IP from the DNS.

Sanjay

Re: PIX DNS resolution issue

johansens — Mon, 06 Jun 2005 09:49:58 GMT

Check this page:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094aee.shtml

Maybe this config will work?

alias (outside) 192.168.2.90 192.168.1.90 255.255.255.255

sysopt noproxyarp outside

Re: PIX DNS resolution issue

sanjay.sangwan — Tue, 07 Jun 2005 03:36:09 GMT

Thanx

I tried the above commands but the nslookup still shows the 192.168.1.90 (actual IP) and I am not through.

Sanjay

Re: PIX DNS resolution issue

a.alekseev — Tue, 07 Jun 2005 03:56:43 GMT

you can also try

static(inside,outside) 192.168.2.90 192.168.1.90 dns

clear xlate

Re: PIX DNS resolution issue

sanjay.sangwan — Tue, 07 Jun 2005 09:26:27 GMT

Hi ,

I had already tried this, I think this is an alternative to alias command in the newer versions.But it didn't work.I also tried to fiddle with the DNS entries.In forward lookup zone in Name server entries if am adding 192.168.2.90 as a second entry , I am able to join the domain from outside.But if I am restarting the server the entry goes off and it stops working.I couldnot understand whether it is a microsoft issue or PIX issue.

Re: PIX DNS resolution issue

leminhkhoi79 — Fri, 24 Jun 2005 07:20:24 GMT

Long time ago, i had the same problem, i asked a Microsoft technical, and I know that AD+DNS can not run with NAT on Pix.

you can try

static(inside,outside) 192.168.1.90 192.168.1.90

clear xlate

Re: PIX DNS resolution issue

sanjay.sangwan — Sat, 25 Jun 2005 03:21:37 GMT

I tried the following on the PIX and I am through

static(inside,outside) 192.168.2.90 192.168.1.90 dns

This command does DNS doctoring through NAT.

thanks

Re: PIX DNS resolution issue

jsalminen — Thu, 07 Jul 2005 21:15:24 GMT

Are you using a Windows 2003 DNS server? If so there is a known issue with DNS packet size and Windows 2003. To resolve you'll have to increase dns fixup on your pix to a larger packet size. Increasing the size of course requires 6.3 or greater Pix IOS.