expressway record

[Toss Leey]

I have dns domain on dmz (.dmz.com) and have separate dns domain on internal (lan.com), my question is if i create A records for expressway-E will be on DNS in DMZ Domin which different than servers on internal dns, is there issue on that, ?

[Roger Kallberg]

This is one of the deployment options outlined in the configuration guides. For details please see the documentation page Expressway Configuration Guides 

[Nithin Eluvathingal]

Expressway E will always be in your public domain, i assume  your DMZ domains is your Public Domain. Create a zone in your internal DNS and add an A record under this zone that resolves to your Expressway E's internal NIC IP. This way, Expressway C  can connect to Expressway E via its internal NIC, while external connections will reach the Expressway public interface.

This applies to the dual NIC configuration. I'm not very familiar with the single NIC configurations of Expressway E.

[Roger Kallberg]

Why would internal clients connect to the E? Those should resolve the internal SRV record and bypass Expressway altogether. Or am I’m missing something in the OPs question?

[Nithin Eluvathingal]

My apologies for the confusion. I didn't mean that internal devices need to communicate with the Expressway, as it's not required. What I was trying to say is that C should resolve the hostname of E to the internal NIC.

[Toss Leey]

the expressway-E dual nic which both in DMZ zone in two subnet, and Expressway-C in internal Zone, and each zone has own domain/dns

[Nithin Eluvathingal]

I didn't quite understand what you meant by your reply.

Expressway E will be in the DMZ and must be in your public domain, while the C will be in the internal domain. The Expressway E's external NIC IP will be NATed to the public IP, and the internal NIC IP  will be used for the C to communicate. The C resolves the FQDN of the E server and connects with the internal NIC IP using the DNS entry you created in your internal DNS for public zone.

[Toss Leey]

the expressway-E both LAN1/LAN2 in DMZ zone, LAN2 will be natted to public and LAN1 will be communicate with expressway-C but the exp-c will not in same subnet as exp-e, so i have to create same dsn record for exp-E in DMZ zone dns and in internal zone dns ?

[Nithin Eluvathingal]

First of all, I assume the your DMZ domain is the Public Domain.

In that case, the Expressway will be in the Public Domain.

Let's assume abc.com is your public domain and your internal domain is xyz.org. The Expressway domain will be abc.com. When Expressway C wants to communicate with E using the FQDN, which is technically the Internal NIC of the Expressway, there is no record that can resolve it internally.

So, what we do is create a zone abc.com internally and create an A record saying expressway.abc.com, which resolves to the IP address of the Expressway's Internal NIC.

Hope this makes it clearer.