Hi,

We have One winows 2003 Domain controller acting as Dhcp and Dns for LAN Users.

Users get IP address and DNS from this Server.

On ASA I have inside, outside and a static NAT for OWA ( Outlook Web Access )

This static nat is private to public so anyone from outside can access Email using OWA

You can open DNS UDP port 53 in outbound direction for your AD server and configure forwarders in the DNS server setup.

You can use the public DNS server like 8.8.8.8 by google, or well known 4.2.2.2 or open DNS servers

As second option you can set up linux BIND internet caching server on your local network and configure AD DNS forwarder to that IP.

This will help to reduce load on AD and will not directly expose AD servers to internet.

Dileep

saquib,

Are you able to browse the internet?

I see you are getting Non-authoritative answer: The first thing that you need to understand about NSLOOKUP is that when you use the NSLOOKUP command, it assumes that you are querying a local domain on your private network. You can query an external domain in your case yahoo.com, but NSLOOKUP will try to search for the domain internally first. For example, the yahoo.com domain is external to your network. Non-authoritative answer is when NSLOOKUP queries an external domain.

Couple of things to check on your DNS server to get you to browse the internet via your Internal DNS server.

1, make sure your DNS Forwarders are configured correctly. You should be using your ISP DNS servers as forwarders. Contact you ISP to get details.

2, Make sure you have the reverse lookup zone configured correctly, and enable it to accept dynamic updates

3, Please Post ipconfig /all for your DNS server and one of your PC. - Your DNS server should have itslef as DNS server and your host PC's should also have your internal DNS server as their DNS server.

4, Can the server access the internet? Is this the only server in the domain or are there other dc's. Also are they all windows DNS.

Also you do not need to open any port or make any inbound NAT change on you FW to your inside DNS server. Just make sure DNS is permitted outbound.

You can also check out this which is a useful checklist for starters,
HOW TO: Configure DNS for Internet Access in Windows
http://support.microsoft.com/default.aspx?scid=kb;EN-US;300202

Hope that helps

francisco

Hi

I am able to browse internet but very slow

when I do nslookup, i  get timeout 5/3 attempts, this could cause slow browsing, I suspect??

Can  update the root Hint , by using copy from server option in DNS server properties.

Also make sure that you have configured forwarders in all your DNS server.

I have second setup mentioned in earlier post,  and do not have any issue with DNS external query.

Keep in mind that for each new domain query DNS server should get replay from external servers, so that first query it will take more time compared to successive queries.

Timeout also casue by external DNS server issues, try to use other servers.