Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

Help with internal DNS trouble

Hello, I´m Javier from Spain

I have a strange issue with my new ASA 5512 and my corporate DNS servers.

my lan net is /16, the default gateway is the INTERNAL ASA IP and the DNS servers ( and are located in another building connected throw a peer to peer connection

this is my problem, with this configuration, I CAN successfully PING any host I need, other hosts in my lan, hosts in /16, my DNS servers, and any host or web in internet

But the DNS servers are not responding my DNS queries, so I CANNOT ping

if I set my defaut gateway as, with the same coroprate DNS servers( and .20), I CAN ping, and if I set my defaut gateway as and use the google DNS ( and I can ping

as you can see in the picture, to reach the /16 from the ASA, the information goes to the ASA throw the INTERNAL interface, and then goes to the leaving the ASA throw the INTERNAL interface

I think i have here an assimetric routing, because I am not natting the traffic destined to the /16, and then, when the traffic come back, when it arrived to the ISP router, the destination IP address will be, and not, so the traffic will go throw different way when go from to

You can find attached a txt file with the show running at the ASA, and a picture with the network topology.

I will really appreciate any help, I´m very stuck with this.

I apologize for my English.


  • Firewalling
Everyone's tags (3)

Re: Help with internal DNS trouble

Hi Bro

This is not a strange issue, this is a network design problem indeed. This network design is badly done. Anyhow, please make the config changes as shown below, and let me know how it goes;

no nat (INTERNAL,INTERNAL) source static NETWORK_OBJ_172.20.0.0_24 NETWORK_OBJ_172.20.0.0_24 no-proxy-arp route-lookup
no nat (INTERNAL,INTERNAL) source static any any no-proxy-arp route-lookup

no object network
no object network

no access-group INET_OUT out interface INET
no access-group INET_OUT out interface INTERNAL

However, the best way here is, to perform static NAT on the Router that holds the IP Address, as shown below;

ip nat inside source static

ip nat inside source static

Note: This is assuming no one is using and

All the workstations in 172.15.XXX.XXX/16 will have their DNS pointing to and

This will resolve your DNS issue.

With regards to your design, I would rather place the FW in transparent mode sitting in between the Router and the LAN (Proposed Network Design - by Ramraj.jpg), then to have it routed mode, as shown in your diagram.

Warm regards, Ramraj Sivagnanam Sivajanam Technical Specialist/Service Delivery Manager – Managed Service Department

Re: Help with internal DNS trouble

Thanks, I´ll check it out next monday.