I'm having an issue with my cisco 1921 router not forwarding DNS requests to our local DNS server. I recently set up NAT NVI and after doing so DNS is no longer being passed between the few VLANS that are in place.
The DNS server for this domain is located at 192.168.1.20 (VLAN1). Client machines are configured to talk to this local DNS via DHCP that are on the 192.168.2.X (VLAN2) subnet.
Currently all DNS requests are only working for machines that are within the VLAN 1 (192.168.1.X). For a machine that is on a different VLAN all DNS queries are failing.
I believe this is an issue with the current routing table but am not sure. My client machine on VLAN2 (ip 192.168.2.100) can successfully communicate (ping, SSH) with the DNS server, but local DNS queries are not making it across the router. I can configure a machine to use my ISPs DNS (184.108.40.206) and it can access the internet successfully, but any local hostname lookups fail.
I tried running some debug on the router to track down the issue but was getting flooded with NAT NVI translations making it fairly difficult to troubleshoot this. I still trying to get smart on the debug features.
My current configuration is as follows:
Current configuration : 2044 bytes ! ! Last configuration change at 03:05:26 UTC Mon Apr 7 2014 version 15.2 service timestamps debug datetime msec service timestamps log datetime msec ! ! ip dhcp excluded-address 192.168.2.1 192.168.2.99 ! ip dhcp pool VLAN2 network 192.168.2.0 255.255.255.0 default-router 192.168.2.1 dns-server 192.168.1.20 220.127.116.11 18.104.22.168 domain-name mydomain.com ! ! ! ip name-server 192.168.1.20 ! ! interface Embedded-Service-Engine0/0 no ip address shutdown ! interface GigabitEthernet0/0 ip address 22.214.171.124 255.255.255.240 ip nat enable duplex auto speed auto no mop enabled ! interface GigabitEthernet0/1 no ip address ip nat enable duplex auto speed auto ! interface GigabitEthernet0/1.1 encapsulation dot1Q 1 ip address 192.168.1.1 255.255.255.0 ip nat enable ! interface GigabitEthernet0/1.2 encapsulation dot1Q 2 ip address 192.168.2.1 255.255.255.0 ip nat enable ! interface GigabitEthernet0/1.3 encapsulation dot1Q 3 native ip address 192.168.3.1 255.255.255.0 ip nat enable ! ip forward-protocol nd ! no ip http server no ip http secure-server ! ip nat source list 1 interface GigabitEthernet0/0 overload
ip nat source static tcp 192.168.1.20 8443 interface GigabitEthernet0/0 8443 ip nat source static tcp 192.168.1.4 443 interface GigabitEthernet0/0 443 ip nat source static tcp 192.168.1.25 80 interface GigabitEthernet0/0 80 ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 126.96.36.199 ! access-list 1 permit 192.168.0.0 0.0.3.255 dialer-list 1 protocol ip permit !
Any comments or tips in this matter would be greatly appreciated!
I enabled ip domain-lookup and that did not seem to make any difference. I did some further investigation and VLAN1 is acting as a DMZ with the servers residing there. For all other VLANS when you try to hit VLAN 1 it goes through Outside -> Inside port translation. I would like to have inter VLAN communication maintain their private IPs if at all possible.
Using tcpdump on the DNS server (192.168.1.20) I am am seeing ping requests from VLAN 2 be translated to global IP address instead of the private 192.168.2.X. Sample tcpdump output:
Here is the output from show ip route if this helps with tracking this issue down:
Gateway of last resort is 188.8.131.52 to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via 184.108.40.206, GigabitEthernet0/0 220.127.116.11/16 is variably subnetted, 2 subnets, 2 masks C 18.104.22.168/28 is directly connected, GigabitEthernet0/0 L 22.214.171.124/32 is directly connected, GigabitEthernet0/0 192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks C 192.168.1.0/24 is directly connected, GigabitEthernet0/1.1 L 192.168.1.1/32 is directly connected, GigabitEthernet0/1.1 192.168.2.0/24 is variably subnetted, 2 subnets, 2 masks C 192.168.2.0/24 is directly connected, GigabitEthernet0/1.2 L 192.168.2.1/32 is directly connected, GigabitEthernet0/1.2 192.168.3.0/24 is variably subnetted, 2 subnets, 2 masks C 192.168.3.0/24 is directly connected, GigabitEthernet0/1.3 L 192.168.3.1/32 is directly connected, GigabitEthernet0/1.3
Question We run asr9001 with XR 6.1.3, and we have a very long delay to
login w/ SSH 1 or 2 to the device compare to IOS device. After
investigation, the there is 1s delay between the client KEXDH_INIT and
the server (XR) KEXDH_REPLY. After debug ssh serv...
Introduction The purpose of this document is to demonstrate the Open
Shortest Path First (OSPF) behavior when the V-bit (Virtual-link bit) is
present in a non-backbone area. The V-bit is signaled in Type-1 LSA only
if the router is the endpoint of one or ...
Hi, I am seeing quite a few issues with patch install and wanted to
share my experience and workaround to this. Login to admin via CLI, then
access root with the “shell” command Issue “df –h” and you’ll probably
see the following directory full or nearly ...