Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

PIX and DNS inside DMZ

is it possiable to put dns inside DMZ?

if so Pls give me some knowledge.

Thanks.

4 REPLIES
Bronze

Re: PIX and DNS inside DMZ

yes, why not?

static (dmz,outside) dns_outside_ip_address dns_dmz_ip_address netmask 255.255.255.255

access-list OUTACL permit udp any host dns_outside_ip_address eq 53

access-list OUTACL permit tcp any host dns_outside_ip_address eq 53

access-group OUTACL in interface outside

static (inside,dmz) inside_ip_addresses inside_ip_addresses netmask inside_netmask

the below link is DMZ scenario with mailserver

http://www.cisco.com/warp/public/110/mailserver_dmz.html

New Member

Re: PIX and DNS inside DMZ

I setup our dns servers inside a dmz in May of 2004. These are authoritative for our zones. During this time I have experienced no problems what so ever with NAT or the ACLs. I use ssh to manage the dns servers from my desktop, as the servers are headless. We have some servers in the internal network that use the authoritative dns servers as their primary and secondary dns servers. I have added 2 more dmz's over the past year. The servers or hosts in these dmz's use a non-authoritative slave dns server as their primary, and the secondary is the authoritative slave dns server in the first dmz. This was done to minimize the traffic to the main dns servers, whose main purpose is to answer queries about hosts within our zones.

You can setup static translations and an ACL for the internal hosts to access the dns servers as well. This would be done similar to the way expained in the other post.

Just be sure to only allow zone transfers to specific hosts (slaves), otherwise you may be in for a rude awakening.

Enjoy the work!

Roger

New Member

Re: PIX and DNS inside DMZ

DO i need to chande in my DNS Configuration, my dns is now configure with public IP without firewall.

New Member

Re: PIX and DNS inside DMZ

Pls, what is ur dns configuration, is it configure with public IP, or with ur local private ip?

206
Views
0
Helpful
4
Replies