How inside users access inside server through pix firewall ?

[lprong]

I have a web server on the inside interface of the Cisco Secure PIX Firewall. It is mapped to an outside public address. I want my inside users to be able to access this server by its DNS name or outside address. How can this be done?

[mmeditz]

Hi,

Sounds like you need DSN Doctoring by using the "alias" command.

See this link:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094aee.shtml

Good luck,

Mike

[lprong]

Hi,thanks ,I have finish it with "alias" command.but I have to config more

command list on pix.And I found the other solution on cisco web site,just list

below:

The other option is actually better because it is more reliable. Take the 99.99.99.x subnet off the PIX and router. Choose an RFC1918 numbering scheme not being used internally (or on any perimeter PIX interface). Then put a route statement back to the PIX for this network and remember to change your PIX default route outside to the new IP address on the router. The outside router will receive this packet and route it back to the PIX based on its routing table. The router will no longer ignore this packet, because it has no interfaces configured on that network.

but I try some times, but failure,anybody can help experiment it with the

way above?thanks!

[taikenison]

Hi, I was advised by Cisco tech to avoid using the "alias" command. Instead, use the "DNS rewrite" parameter that is part of the "static" command. (Assuming you're on PIX OS 5.x or better).

If you're using PDM, go to the Translations Rules tab, click on the Advance button, and then check the "DNS Rewrite" box for each rule you want an inside user to be able to access an inside resource via name rather than IP address.

If only CLI, here's an example line:

static (inside,outside) 216.x.x.x 192.y.y.y dns netmask 255.255.255.255

Hope this helps. This was the only thing that helped us.

Tai

[jmia]

Hi Lin -

Little confused by your post, firstly you say that you have a inside server which you want your inside users to have access to - am I correct in this thought, or is this server on a outside interface i.e. DMZ ? If it is in DMZ then pls read the following document: http://www.cisco.com/warp/public/707/28.html

Thanks - Hope this helps ---

[wolfrikk]

I would set it up so your users use the DNS name, but use the inside IP Address of the server. You can accomplish this by having an internal DNS server or using host files.