dnc doctoring issue on FTD

[surugupt]

• Users are trying to access the internal server pcs.savvas.com from one of their remote locations. The server is hosted on a private DNS.
• When pcs.savvas.com resolves to the public IP 8.20.x.x, users are experiencing issues accessing the application.
• When pcs.savvas.com resolves to the private IP, no issues are observed.

[Karsten Iwen]

What is your question? Your bullet point 2 is exactly what DNS doctoring is designed to solve. But the DNS request has to flow through the device that does the NAT for this server.

[surugupt]

Hi Thank you for your response, I verified the existing NAT rule, which is a Manual NAT Rule of type Static, Verified the Access Control Policy (ACP) for pcs.savvas.com on the customer's device. also wanted to mention that the dns server is in inside network.
NAT rule was created correctly. I'm wondering what other things I should check to help customer.

[Karsten Iwen]

Things to check:

• Does the DNS request flow through the NAT firewall
• Is DNS doctoring enabled
• capture on both FTD interfaces the DNS response and see if the IP gets rewritten

[MHM Cisco World]

this option needed