topic Re: internal dns resolution in Network Security

internal dns resolution

born.jason — Mon, 11 Mar 2019 19:32:47 GMT

Hi,

i have a problem with a hosted server inside of our network. It is a customer mailserver. If i now try to telnet from inside to the server "mail.domain.com 25" it does not work. Only with the inside IP it works. How could i configure the asa to resolve the domain name right? I don`t want to add a dns entry on the inside.

FYI:

we have an external ip range routed to the asa and the internal mail server has a nat rule for this external range.

Thanks

Jason

Re: internal dns resolution

Jennifer Halim — Mon, 10 Jan 2011 09:51:53 GMT

You can use DNS doctoring to resolve the issue if the DNS request/reply actually goes through the ASA as well.

If the mail dns entry is hosted externally, and I believe that you would probably have a static NAT statement to NAT the mail server private IP to public IP so it's accessible from the outside, then you can add the keyword "dns" on the static NAT statement of the mail server.

You would need to perform dns flush on your internal machines once the above is configured so it requests for the dns entry again, and when the dns traffic passes through the ASA, the DNS doctoring will translate the DNS entry for your mail server to its private ip address so it's reachable via its private ip address from your internal network.

Here is a sample configuration on DNS doctoring for your reference:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807968d1.shtml

Hope that makes sense.

Re: internal dns resolution

born.jason — Mon, 10 Jan 2011 12:10:27 GMT

Thanks Jen, this was it.