10-31-2006 08:22 AM - edited 02-21-2020 01:16 AM
I have an ASA5510 and have it configured with the STATIC NAT entries for Web servers in MY DMZ but when I add the DNS to the end of the STATIC rule it does not modify the DNS reply so that the nat'd address is sent to an outside client. I have done this successfully with a PIX firewall running the same IOS.
10-31-2006 08:29 AM
Can you paste the config?
Regards,
10-31-2006 10:23 AM
Here you go:
ASA Version 7.1(2)
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 55.23.239.130 255.255.255.128
!
interface Ethernet0/1
nameif DMZ
security-level 30
ip address 10.10.30.1 255.255.255.0
!
interface Management0/0
nameif inside
security-level 100
ip address 10.10.20.129 255.255.255.128
!
dns domain-lookup inside
dns server-group DefaultDNS
name-server colonel
name-server judge
domain-name ISPRO.COM
access-list ASAOutside remark DNS access to outside DNS Servers
access-list ASAOutside extended permit udp any object-group Outside_DNS object-group DNS
access-list ASAOutside remark HTTP WEB ACCESS
access-list ASAOutside extended permit tcp any object-group WebSites object-group HTTP
access-list ASAOutside remark HTTPS WEB ACCESS
access-list ASAOutside extended permit tcp any object-group WebSites_SSL object-group HTTPS
static (DMZ,outside) 55.23.239.26 10.10.30.26 netmask 255.255.255.255 dns
access-group ASAOutside in interface outside
access-group ASADMZ in interface DMZ
access-group ASAInside in interface inside
10-31-2006 12:36 PM
Hello,
The dns option on your static will only work if 'inspect dns' is on - I don't see your global service policy (or interface, for that matter) in the configuration to tell if it is on or not.
--Jason
Please rate this message if helped resolve some or all of your issue!
10-31-2006 12:49 PM
Here is the inspect policy the interfaces are on the previous printout
policy-map asa_global_fw_policy
class inspection_default
inspect ftp
inspect h323 ras
inspect h323 h225
inspect tftp
inspect sqlnet
inspect mgcp
inspect netbios
inspect skinny
inspect ils
inspect icmp
inspect sip
inspect xdmcp
inspect ctiqbe
inspect dns maximum-length 1024
10-31-2006 01:44 PM
You static should look like that:
static (DMZ,outside) udp 55.23.239.26 dns 10.10.30.26 dns netmask 255.255.255.255
Please let me know if it solves your problem,
Regards,
10-31-2006 03:16 PM
didn't help....
10-31-2006 04:42 PM
Can we get the complete config? We're not getting the complete picture here. Feel free to take out SNMP and change IP addresses to protect the innocent.
11-01-2006 08:59 AM
Hi bob,
Do you mean DNS aliasing. For example,
alias (DMZ) Global_ip DMZ_IP
Let me know your feedback coz it seems I did misunderstood your request,
Regards,
10-31-2006 07:08 PM
Hi ... I believe you are a bit confused as to the way the dns option works when used on a static sentence. The dns option will allow an INSIDE host to received a DNS reply with the local IP address used on the translation .ie the real IP of your Web server. In that way your INSIDE host will comunicate direclty with the Web Server instead of trying to connect by using its Public Ip address.
I hope this helps ... please rate it if it does !!!
11-01-2006 09:04 AM
hi all i have a similar situation. i have a webserver in my inside network and there is no local dns server in our network.people in the inside network query the internet dns server for the resolution of the web server in the inside of the pix. say the public ip is 1.1.1.1 and the private ip of the server is 10.1.1.1/24.
in my static nat i have configured
static (inside,outside) 1.1.1.1 10.1.1.1 dns netmask 255.255.255.255.
will the dns doctoring work here. can someone pls help.
regards
sebastan
11-01-2006 12:19 PM
Yes the DNS doctoring/Aliasing would work for you. Any request sent to the public address will be redirected to the internal DNS address.
Your alias command should look like that
Alias (Inside) 1.1.1.1 10.1.1.1 255.255.255.255
Hope this helps,
Regards,
11-01-2006 03:22 PM
HI I believe .. what you need is
static (inside,outside) 1.1.1.1 10.1.1.1 netmask 255.255.255.255 dns
DNS reply from teh External Web server will be rewriten and you internal host will connect directly to the internal IP of your Web server assuming you have allowed access from Inside hosts to it.
I hope it helps .. please rate it if it does !!!
11-28-2006 12:36 PM
Everyone has missed the crucial element of this person's post.
This person doesn't need to know how to get the DNS portion working... they clearly have it correct according to the documentation.
The problem here, which is a problem I have just run into, is that it's not working 100%.
With this command:
static (inside,outside) 209.165.201.10 10.1.3.14 netmask 255.255.255.255
dns
I can do an nslookup of mydomain.com and it will resolve to 10.1.3.14, which is the desired effect. But a ping will resolve to mydomain.com will resolve to 209.165.201.10, and loading mydomain.com into a web browser will not resolve to the correct 10.x address. However, if I load the 10.x address into the browser manually, it works fine.
So the DNS keyword on the static command is the correct solution according to the docs, however it does not function as it should.
One thing to note is that the docs state that either the client or the DNS server must be on the same interface as the web server. So a client on "inside", a web server on "DMZ", and a DNS on "outside" will not work. Which is how it should work. That would be the desired effect for anyone who doesn't run their own DNS servers.
So for the above example, with three host in three separate networks, the alias command did solve the problem, however it breaks the ASDM. While I'm not a fan of the ASDM, our customers are, and it's a feature they've paid to have, they should have the ability to use it.
11-28-2006 09:21 PM
Hi Bob,
Let me ask you a few questions:
- where are your DNS servers?
-who is trying to access the webservers? Hosts from the inside or from the same interface (DMZ)?
For DNS doctoring to work, the request/reply must traverse the firewall, otherwise the packet won't get fixed
So for example if the hosts are located in the DMZ you must have your static configured with the DNS keyword. The when a client makes a request to go to mysite.com, the request will go out to the external DNS servers and will come back with the public address configure on the static, at that moment, the firewall will "open" the packet and replace that information with the private IP address of the server.
If the clients are located on the Inside interface you will need to configure Destination NAT.
static (dmz,outside) x y
static (dmz, inside) x y
Hope it helps
Franco Zamora
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide