I have an ASA5510 and have it configured with the STATIC NAT entries for Web servers in MY DMZ but when I add the DNS to the end of the STATIC rule it does not modify the DNS reply so that the nat'd address is sent to an outside client. I have done this successfully with a PIX firewall running the same IOS.
Here you go:
ASA Version 7.1(2)
ip address 18.104.22.168 255.255.255.128
ip address 10.10.30.1 255.255.255.0
ip address 10.10.20.129 255.255.255.128
dns domain-lookup inside
dns server-group DefaultDNS
access-list ASAOutside remark DNS access to outside DNS Servers
access-list ASAOutside extended permit udp any object-group Outside_DNS object-group DNS
access-list ASAOutside remark HTTP WEB ACCESS
access-list ASAOutside extended permit tcp any object-group WebSites object-group HTTP
access-list ASAOutside remark HTTPS WEB ACCESS
access-list ASAOutside extended permit tcp any object-group WebSites_SSL object-group HTTPS
static (DMZ,outside) 22.214.171.124 10.10.30.26 netmask 255.255.255.255 dns
access-group ASAOutside in interface outside
access-group ASADMZ in interface DMZ
access-group ASAInside in interface inside
The dns option on your static will only work if 'inspect dns' is on - I don't see your global service policy (or interface, for that matter) in the configuration to tell if it is on or not.
Please rate this message if helped resolve some or all of your issue!
Here is the inspect policy the interfaces are on the previous printout
inspect h323 ras
inspect h323 h225
inspect dns maximum-length 1024
You static should look like that:
static (DMZ,outside) udp 126.96.36.199 dns 10.10.30.26 dns netmask 255.255.255.255
Please let me know if it solves your problem,
Can we get the complete config? We're not getting the complete picture here. Feel free to take out SNMP and change IP addresses to protect the innocent.
Do you mean DNS aliasing. For example,
alias (DMZ) Global_ip DMZ_IP
Let me know your feedback coz it seems I did misunderstood your request,
Hi ... I believe you are a bit confused as to the way the dns option works when used on a static sentence. The dns option will allow an INSIDE host to received a DNS reply with the local IP address used on the translation .ie the real IP of your Web server. In that way your INSIDE host will comunicate direclty with the Web Server instead of trying to connect by using its Public Ip address.
I hope this helps ... please rate it if it does !!!
hi all i have a similar situation. i have a webserver in my inside network and there is no local dns server in our network.people in the inside network query the internet dns server for the resolution of the web server in the inside of the pix. say the public ip is 188.8.131.52 and the private ip of the server is 10.1.1.1/24.
in my static nat i have configured
static (inside,outside) 184.108.40.206 10.1.1.1 dns netmask 255.255.255.255.
will the dns doctoring work here. can someone pls help.
Yes the DNS doctoring/Aliasing would work for you. Any request sent to the public address will be redirected to the internal DNS address.
Your alias command should look like that
Alias (Inside) 220.127.116.11 10.1.1.1 255.255.255.255
Hope this helps,
HI I believe .. what you need is
static (inside,outside) 18.104.22.168 10.1.1.1 netmask 255.255.255.255 dns
DNS reply from teh External Web server will be rewriten and you internal host will connect directly to the internal IP of your Web server assuming you have allowed access from Inside hosts to it.
I hope it helps .. please rate it if it does !!!
Everyone has missed the crucial element of this person's post.
This person doesn't need to know how to get the DNS portion working... they clearly have it correct according to the documentation.
The problem here, which is a problem I have just run into, is that it's not working 100%.
With this command:
static (inside,outside) 22.214.171.124 10.1.3.14 netmask 255.255.255.255
I can do an nslookup of mydomain.com and it will resolve to 10.1.3.14, which is the desired effect. But a ping will resolve to mydomain.com will resolve to 126.96.36.199, and loading mydomain.com into a web browser will not resolve to the correct 10.x address. However, if I load the 10.x address into the browser manually, it works fine.
So the DNS keyword on the static command is the correct solution according to the docs, however it does not function as it should.
One thing to note is that the docs state that either the client or the DNS server must be on the same interface as the web server. So a client on "inside", a web server on "DMZ", and a DNS on "outside" will not work. Which is how it should work. That would be the desired effect for anyone who doesn't run their own DNS servers.
So for the above example, with three host in three separate networks, the alias command did solve the problem, however it breaks the ASDM. While I'm not a fan of the ASDM, our customers are, and it's a feature they've paid to have, they should have the ability to use it.
Let me ask you a few questions:
- where are your DNS servers?
-who is trying to access the webservers? Hosts from the inside or from the same interface (DMZ)?
For DNS doctoring to work, the request/reply must traverse the firewall, otherwise the packet won't get fixed
So for example if the hosts are located in the DMZ you must have your static configured with the DNS keyword. The when a client makes a request to go to mysite.com, the request will go out to the external DNS servers and will come back with the public address configure on the static, at that moment, the firewall will "open" the packet and replace that information with the private IP address of the server.
If the clients are located on the Inside interface you will need to configure Destination NAT.
static (dmz,outside) x y
static (dmz, inside) x y
Hope it helps