I have a PIX version 6.1. My web server and DNS server are on the inside of the PIX. My internal clients cannot reach the web server using it's public address or domain name.
Is there any way that I can use the alias command or anything else to do dns doctoring when the dns server is on the inside interface of the pix? I don't want to add a second dns server to resolve to private addresses or move the dns server to the outside or dmz if I don't have to.
You cannot use any command in the PIX. If your DNS server, WEB server and the clients using them are on the same network, they are not controled by the PIX. They communicate directly. In a network that is small, you can use the client's host table to define the web servers name to inside address, otherwise you must place the PIX between the WEB server and it's clients(DMZ). Another solution would require a router between the PIX and the inside network.
No it's Wrong ! Host in inside demand to the Dns Where is the www.example.com the DNS resolve it to 188.8.131.52 ( Public Adress ) and THE PIX can say : If someone in inside want to connect to 184.108.40.206 so it must go on the Inside Private IP address
On careful reading of the Command Reference I see that in both examples, the DNS reply crosses the PIX because the DNS server is outside. In this senario the DNS reply doesn't, it goes directly to the client.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
[toc:faq]Introduction:This document describes details on how NAT-T
works.Background:ESP encrypts all critical information, encapsulating
the entire inner TCP/UDP datagram within an ESP header. ESP is an IP
protocol in the same sense that TCP and UDP are I...