VPN Guest Network - DNS Rewrite

[BlueMCisco]

Hi,

I have remote access VPN set up on my outside interface. External DNS is pointing vpn.contoso.com to this outside interface. I also have a PAT policy for some of my 'Inside' traffic to use this same outside interface IP address.

I'd like to be able to use vpn.contoso.com from my 'guest' network, which uses external DNS, for VPN connectivity. I have enabled remote access VPN on my 'Guest' interface. I know that I cannot use DNS rewrite on a PAT policy. Is there any other option to allow this to work? Could I possibly create a separate static NAT policy translating my 'Guest' interface IP to my 'Outside' interface IP? If yes, would I need to first remove the PAT policy for my inside traffic?

Thanks,
Blue

[Varinder Singh · Accepted solution]

Hi,

Couple of things.

1. you cannot connect to outside interface VPN coming from Guest interface and You cannot nat outside interface to guest interface. It is not possible.

2. The only way to make it work is to have resolution of vpn.contoso.com to Guest interface for users connected to guest interface.

Hope that answers your query.

Varinder

[BlueMCisco]

Thank you for the quick reply.

The guest network uses public DNS so I'm not sure how that is possible. Is there a way in the ASA to manipulate the DNS response for queries coming from the guest network (other than DNS rewrite)?

FYI, I'm using the ASA 5520.

Thanks,

Blue

[Varinder Singh]

I'm afraid there is no other way to manipulate DNS queries for fqdn to resolve on 2 IP address, One on outside and another on guest interface.  ASA only intercepts for static nat which has dns keyword configured.

the easy way is to have them connect on IP address of guest interface or have another fqdn vpn2.contoso.com to resolve guest interface ip address.

Varinder