12-22-2009 06:41 AM - edited 03-11-2019 09:51 AM
Hi,
Following is the setup in which I am facing some problem:
Client)--------(in)PIX(out)--------Router------DC/DNS
Client real IP: 192.168.1.13
Client NATed IP: 172.26.3.13
Client computer Name: COMPUTERA
There is a static NAT on the PIX firewall with DNS re-write option for the client. Client is successfully joining the domain. But in the DNS 'A' records following entry is coming
COMPUTERA--------192.168.1.13
I have checked on the PIX & found that all relevant inspects(netbios & dns) are enabled but I am wondering why the NATed IP is not appearing on the DNS .....I think this has some thing to do with NETBIOS rewrite on the PIX.......
Following is the config on the PIX
interface Ethernet0
nameif outside
security-level 0
ip address 172.26.3.2 255.255.255.0
!
interface Ethernet1
nameif inside
security-level 100
ip address 192.168.1.2 255.255.255.0
access-list outside_access_in extended permit ip any any
access-list outside_access_in extended permit icmp any any
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit icmp any any
static (inside,outside) 172.26.3.13 192.168.1.13 netmask 255.255.255.255 dns
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 172.26.3.1 1
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect dns preset_dns_map
!
service-policy global_policy global
PIX# show version
Cisco PIX Security Appliance Software Version 7.2(2)
12-22-2009 08:29 AM
I believe this may be due to DNS re-write. Why do you have DNS re-write? Do people on the inside try to access the server with its 172.26.3.13 address?
-KS
12-22-2009 08:59 AM
I have removed dns re-write option but the problem still persists. I think dns re-write option shouldn't affect b/c this problem might be related to NETBIOS......
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide