Content Rule-Based DNS

[subhash]

We have configured the CSS for content rule-based DNS operation for GSLB. The CSS are installed behind a firewall. CSS are configured with private addresses for the services and the VIP. This VIP is translated at the firewall for external access.

In this scenarion, when the CSS receives a DNS query it returns the VIP (private address) and hence the clients can't reach. How can I change it to retun the public address to the user.

[Gilles Dufour]

the firewall needs to inspect the dns response and nat the private address into public address.

This is called dns doctoring and can be done on a Cisco pix firewall with the command 'alias'.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094aee.shtml

Regards,

Gilles.

[subhash]

Thank you Gilles. I knew the dns doctoring. I wanted to know if there is any workaround within CSS. Thank you for the confirmation.

[Gilles Dufour]

you can configure the CSS to return the public ip address.

But internal users that may require to use the private ip address will also receive the public ip address.

To configure the CSS, you need to use dns a-record and therefore use dns zone-based solution instead of rule-based.

http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_configuration_guide_chapter09186a00801eebaa.html

Regards,

Gilles.