Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

How to config PIX 506E to pass DNS traffic

I have a PiX 506E that is used by a public municiple agency to seperate one internal LAN from Another for security reasons. On the outside interface of the PIX is a less secure network (192.168.10.x) with a Windows 2003 Domain controller running DNS. We have installed another secondary domain conroller for the same domain on the inside interface (172.23.16.x). Since both domain controllers are for the same domain we need to configure the firewall to allow the domains to talk to each other. The DNS server on the outside interface is 192.168.10.2 and the second DNS server on the inside interface is 172.23.16.7. Curretnly SMTP and WWW traffic is passing through with no problem. I have attatched a sanitized running config to look at. I'm not sure where I am missing it but I have been unable to open the ports to get the two to talk together. Any help would be appreciated. Thanks

8 REPLIES
Silver

Re: How to config PIX 506E to pass DNS traffic

Hi ..

Please execute following commands-

no static (inside,outside) 192.168.10.2 172.23.16.7 netmask 255.255.255.255 0 0

clear xlate local 172.23.16.7

clear xlate global 192.168.10.2

Hope that helps. Also let me know if we are talking about DNS replication over here? Or normal DNS queries not going through?

Regards,

Vibhor.

Community Member

Re: How to config PIX 506E to pass DNS traffic

I'm trying to get DNS replication to take place between the outside DNS Server (192.168.10.2) and the inside server (172.23.16.7). I tried the commands you gave me and it didn't seem to work.

Green

Re: How to config PIX 506E to pass DNS traffic

I think DNS replication should take place with Active Directory replication.

Community Member

Re: How to config PIX 506E to pass DNS traffic

It's the DNS replication that I cannot get working. When I go to active directory sites and services and try to replicate to the other server it tells me now that the rpc server is unavailable.

Green

Re: How to config PIX 506E to pass DNS traffic

Most likely is attempting rpc 135 connection on some random port.

Community Member

Re: How to config PIX 506E to pass DNS traffic

I ran accross this Microsoft article on setting some regestry settings on both domain controllers to limit the number of port rpc is using. Is this the only way to allow rpc traffic or is their a better suggestion on how to do what I am trying to accomplish.

http://support.microsoft.com/kb/154596

Green

Re: How to config PIX 506E to pass DNS traffic

Before you get into stuff like that, which when dealing with the registry would never be my first choice, get some logging going on the pix, try your replication and see exactly what is going on. No sense ruining your perfectly good domain controllers when you don't need to. Post up the logs.

Silver

Re: How to config PIX 506E to pass DNS traffic

If we are only talking about DNS zone transfers, it works on TCP(53), which is open on your PIX. However, if you are looking for WINS replication, for this we need to open port 42 (TCP n UDP). Are we only doing Zone transfers or WINS replications also?

Is it possible to collect syslogs at the time you try to replicate?

Regards,

Vibhor.

480
Views
0
Helpful
8
Replies
CreatePlease to create content