cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

394
Views
0
Helpful
0
Replies
Highlighted
Beginner

DNS Doctoring + Site to Site VPN

My reading seems to suggest that DNS Doctoring will be incompatible across a site-to-site VPN with an overlapping network range. I wish to setup an AD trust / DNS Forwarding between 2 x sites. I have a Domain Controller / DNS server on Site A: 10.0.1.0/24 and a remote site, Site B: 10.0.5.0/24 (reachable via a site-to-site VPN) that needs to access it. The problem is that Site B is connected to a WAN on which another office is connected that also uses 10.0.1.0/24. Clearly NAT is required to translate the overlapping addresses space between Site A and B. When building the crypto ACL using twice NAT I don't believe that I can use DNS doctoring to translate the A record for 10.0.1.1 to 192.168.1.1 as Object NAT (with the DNS keyword) won't be matched, i.e. twice NAT will take priority. See end of the following URL. https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115753-dns-doctoring-asa-config.html I'm assuming that my best course of action is to use a second Firewall behind my ASA (VPN Firewall) to do the translation of the A Record for the remote site and then the ASA (VPN Firewall) for the VPN itself. Can anyone offer any guidance please. Regards Darren
0 REPLIES 0
Content for Community-Ad