Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

URL problem

Hi guys, I have a problem. I have a Pix 515e, with outside, inside, and dmz interfaces, the web side is in the dmz, from the outside the web site works fine, but from the inside I can't access to it using www.xxxx.com, only using http://10.2.2.3, which is the IP in the dmz. Any idea?

Thanks.

1 REPLY

Re: URL problem

This is normal behavior because the PIX does not allow to to leave via the public IP to the outside interface and then come back to the DMZ !

There is feature called DNS rewriting that may help you to solve that.

Check this post:

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1dd65552/0#selected_message

The DNS rewrite only works if the DNS response traverses the interface listed in the static command. In your example using this command:

static (dmz,outside) 1.1.1.27 172.16.16.27 dns

then the DNS response would have to come in on the DMZ interface. You have stated though that your DNS server is on the inside interface, so the above static is not going to work. This also explains why it works when you change the interfaces to (inside,outside), since the DNS reponse is seen on the inside interface and it therefore gets changed correctly. Note also how the old alias command specified the "inside" interface.

Now, do you really need a DNS static here? If this is for outside people to connect, then they'll return a DNS entry of 1.1.1.27 and your standard static of

static (dmz,outside) 1.1.1.27 172.16.16.27

that is already configured will do the trick.

If you're trying to set it up for inside people, then it depends on what IP address the inside DNS server returns. If it returns the 172.16.16.27 address then you don't need to do anything. If it returns the 1.1.1.27 address then you don't need "DNS rewriting", you need "destination NAT'ing". You do this also with a static as such:

static (dmz,inside) 1.1.1.27 172.16.16.27 netmask ..

Note how the interfaces are swapped around as per a normal static. This says that if I see a packet for 1.1.1.27 on the inside interface, change the destination to 172.16.16.27 and forward it out the DMZ interface.

Remember that the alias command had two functions, DNS rewrites and destination NAT (http://www.cisco.com/warp/public/110/alias.html). I have a feeling that the alias command you had in this PIX wasn't doing a whole lot depending on where your DNS server was located and what IP address it returned.

sincerely

Patrick

80
Views
0
Helpful
1
Replies
CreatePlease to create content