DNS and PROXY Problem

[badih_abifadel]

I have the following Scenario: A LAN with internal DNS server, the LAN is connected through a PIX Firewall to the internet (Integrated with WebSense).

their WEB server is hosted at the ISP site (EXTERNAL to the PIX). the domain name of the web server is the same domain name as the active directory (inside the LAN). eg: www.test.com .

if a user in the inside zone type www.test.com he can not reach the web page. while any user on the internet can access the web page by typing www.test.com

Can I solve this problem without changing the domain name.

[bdube]

Your DNS is inside, then if it does resolution only for inside users, you just have to edit the Alias record with the inside IP address, not the public. If your inside DNS serves also outside users, you have to move it to DMZ or Outside and use DNS doctoring feature (Alias command).

Regards

Ben

[badih_abifadel]

I do not have outside users using my internal DNS.

can you please elaborate more.

Regards

badih

[jmia]

Hi Badih,

The following document will give you a better understanding of 'alias and DNS Doctoring' :-

http://www.cisco.com/warp/public/110/alias.html

Hope this helps.. Jay

[badih_abifadel]

Hi Jay,

My Internal DNS, is pointing to the ACTIVE DIRECTORY domain name, (which is inside the INTERNAL zone)

the ISP EXTERNAL DNS is pointing toward the WEB server (they both "EXTERNAL DNS and WEB Server" are on the external zone at the ISP site.

the ACTIVE directory domain name is the same as the web page.

so the DNS request by internal users is always replied by the INTERNAL DNS before reaching the PIX.

Regards

[jmia]

Hi,

I'm sorry but what are the problems you are having? I presume that your internal clients have their DNS setting pointing to the inside DNS server? Do you want your internal clients have their DNS request to be answered by the external DNS server, if so then point your internal clients DNS setting to the outside DNS server IP address (ISP)DNS.

Let me know your thoughts.. Jay

[badih_abifadel]

Hello jay,

If I change the DNS user to the external DNS, I will be able to reach the EXTERNAL WEB server, but the users will not be able to join the domain.

Regards

[bdube]

You don't have to redirect inside users to external DNS. You just need to add a "A record" to your inside DNS to resolve www.test.com, even if the address is outside your network.

Regards

Ben

[jmia]

Hi -

Have you got a 'A Record' on your inside DNS server to resolve www.test.com, if you haven't then please add this and see if you still have problems.

Thanks - Jay