jwi71
asked on
PIX and DNS Zone Xfer
I am having trouble getting DNS Zone Xfer to pass through the Pix. I have a primary DNS on the inside and a secondary DNS on the outside. I want the secondary DNS to pull a new zone file (when necessary) through the pix. Not working for me. I have provided the relevant PIX configs:
access-list 101 remark --ALLOW DNS AND ZONE XFER--
access-list 101 permit tcp host 32.A.B.C host 32.A.B.D eq domain
access-list 101 permit udp host 32.A.B.C host 32.A.B.D eq domain
global (outside) 1 32.A.B.E
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 32.A.B.D <INTERNAL IP> netmask 255.255.255.255 0 0
The DNS is the first entry in the access-list. There are other entries, but not pertaining to DNS. If this is a little confusing, I need to allow an outside (untrusted) IP to request DNS from an inside (trusted) IP. Secondly, the only communication allowed betwen the two DNS servers is DNS.
The PIX version is 6.3(1).
Any help?
Jeffrey
access-list 101 remark --ALLOW DNS AND ZONE XFER--
access-list 101 permit tcp host 32.A.B.C host 32.A.B.D eq domain
access-list 101 permit udp host 32.A.B.C host 32.A.B.D eq domain
global (outside) 1 32.A.B.E
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 32.A.B.D <INTERNAL IP> netmask 255.255.255.255 0 0
The DNS is the first entry in the access-list. There are other entries, but not pertaining to DNS. If this is a little confusing, I need to allow an outside (untrusted) IP to request DNS from an inside (trusted) IP. Secondly, the only communication allowed betwen the two DNS servers is DNS.
The PIX version is 6.3(1).
Any help?
Jeffrey
I had the same problem long time ago and as I recall I copied the zonefile the first time manually to the seconday. Don't ask me why but after that it worked with the same configuration as you have mentioned here
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
still does not work ?
you might also need to add:
[...]
transfer-source * port 53;
notify-source * port 53;
[...]
you might also need to add:
[...]
transfer-source * port 53;
notify-source * port 53;
[...]
No comment has been added to this question in more than 21 days, so it is now classified as abandoned..
I will leave the following recommendation for this question in the Cleanup topic area:
Split: tim_holman{http:#10883472} & DonConsolio{http:#10969140}
Any objections should be posted here in the next 4 days. After that time, the question will be closed.
Tolomir
EE Cleanup Volunteer
I will leave the following recommendation for this question in the Cleanup topic area:
Split: tim_holman{http:#10883472} & DonConsolio{http:#10969140}
Any objections should be posted here in the next 4 days. After that time, the question will be closed.
Tolomir
EE Cleanup Volunteer