03-11-2013 01:36 PM - edited 03-11-2019 06:12 PM
Today i've moved to a Cisco ASA 5510 and I'm having problems when accessing webservers from the inside.
When I try to access the webserver (helpdesk, webmail, etc) from computers outside my network, everything works just fine. When I try and access the same sites internally, I can't resolve the hostnames - but when I try to access via IP-address everything works.
I seem to have missed something in the access rules, but I can't think of anything..
03-11-2013 01:45 PM
Would need a bit more background information what exactly you have done?
You say you cant resolve hostnames? Wouldnt this just simply mean a problem with DNS server connection or something else regarding the DNS?
One common DNS related problem is fact when you are using for example public DNS which replys to internal host with the public NAT IP address of your server but you cant connect to the server using the public IP address (Firewall limitation). In this cases you would use the "dns" parameter in the NAT configuration automatically rewrite DNS replies before them reaching the internal host and therefore the internal host would actually be connecting with the local IP address of the server.
But I dont really know if this is the case. We dont have much information to go with.
03-11-2013 01:56 PM
When I issue a nslookup command internally, I get DNS request timeout, so yea, it's most likely dns-related. Somehow.
Sorry about the lack of information, I've been working 14 hours straight so far today.
03-11-2013 02:10 PM
We're running both two internal dns-servers aswell as an external primary DNS.
I can reach both my internal DNS-servers OK aswell as the primary DNS (which is located on our DMZ).
nslookup is giving me an "DNS request timed out"-error.
03-11-2013 02:14 PM
You can reach both your servers but they are not replying with that the clients ask.
Try to use a different server [188.8.131.52] while you fix that.
03-11-2013 01:46 PM
Is the DNS server configured in those units and internal or external server? It's probably external, i just want to confirm.
Can you reach your DNS server?
How about a "nslookup" on windows cmd for any of the sites?
03-11-2013 01:49 PM
Where do your servers reside, on the inside network or in a separate , dmz segment? I'll assume you have a separate segment..
First of all, you need to fix the DNS on the clients - either by configuring an appropriate ACL or just specifying the correct DNS sever on the clients.
Then, you have two options: if your servers resolve to external IPs, then you can either create identical static translations from dmz to inside as you have from dmz to outside. The other option is using the dns keyword in your static translations, so ASA can provide DNS doctoring on your outside-bound DNS requests and return your actual DMZ addresses.
Sent from Cisco Technical Support iPad App
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: