Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

DNS and Pix issue

Posted on 2004-10-18
10
Medium Priority
?
445 Views
Last Modified: 2008-02-01
I am having trouble resolving DNS now that I have our Pix 506e installed....

If I hard code the true DNS (not my dns server to fwd to the true dns addresses) into the "Use the following DNS address" then everything works.  However when DHCP assigns the dns server 192.168.1.10 as the DNS (which would resolve the true DNS) then I get nothing.

Here is my ACL:
====================================================================

Result of firewall command: "show running-config"
 
: Saved
:
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password ivL/lG89LSw2/TLx encrypted
passwd xxxxxx encrypted
hostname tristatepix
domain-name tristate.tsppumps.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 101 permit icmp any any
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 66.x.x.x255.255.255.0
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group 101 in interface outside
route outside 0.0.0.0 0.0.0.0 66.83.187.153 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:e8968515ffb2c158eb8c0b24b91b1fd8
=====================================================================

Any help???
0
Comment
Question by:r270ba
  • 4
  • 3
  • 2
  • +1
10 Comments
 
LVL 6

Expert Comment

by:Sebo2000
ID: 12344273
Did you set up forwarding on the DNS 192.168.1.10?
Point forwarding for testing to 4.2.2.1 it is public White House DNS, also on PIX you will need to open port UDP 53 inbound/outbound.
I would not recommend using roothints they are not reliable those days.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12344511
You do not have to open any ports on the PIX.
Your issue is most likely with your DNS server.
The PIX config looks fine.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12344516
Do you have the proper default gateway setup on the DNS Server?
Can you ping a public nameserver from the internal DNS server?
0
Get Certified for a Job in Cybersecurity

Want an exciting career in an emerging field? Earn your MS in Cybersecurity and get certified in ethical hacking or computer forensic investigation. WGU’s MSCSIA degree program was designed to meet the most recent U.S. Department of Homeland Security (DHS) and NSA guidelines.  

 
LVL 5

Expert Comment

by:snowsurfer
ID: 12344952
Your pix config is fine.  If you are using Windows 2003, you may have to turn on the nofixup for dns or increase the size of fixup protocol dns maximum-length 512
.  Windows 2003 has increased the size of the DNS packets and some sites stop resolving.  Yahoo has the had the biggest problem.
0
 

Author Comment

by:r270ba
ID: 12349313
>Can you ping a public nameserver from the internal DNS server?

No I can't...am not sure why...everything has worked fine until I added the Pix....I can however ping the DNS Servers from the computer I am on now.

What could the problem be?
0
 

Author Comment

by:r270ba
ID: 12349346
From above....

192.168.1.10 (My DNS Server) = Cannot ping DNS

192.168.1.12 (Comptuer I am on now) = Can ping DNS fine.
0
 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 1000 total points
ID: 12349407
Post result of "c:\>route print" from your dns server's dos prompt..
0
 
LVL 5

Accepted Solution

by:
snowsurfer earned 1000 total points
ID: 12349427
Your next post will show this, but what is the default gateway on your server?  Is it different than your pc
0
 

Author Comment

by:r270ba
ID: 12350755
Results:
==============================================================

IPv4 Route Table
==============================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10003 ...00 0f 1f 69 e9 0d ...... Broadcom NetXtreme Gigabit Ethernet
0x10004 ...00 0f 1f 69 e9 0e ...... Broadcom NetXtreme Gigabit Ethernet #2
==============================================================
==============================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.5     192.168.1.11     10
          0.0.0.0          0.0.0.0      192.168.1.5     192.168.1.10     10
        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
      192.168.1.0    255.255.255.0     192.168.1.10     192.168.1.10     10
      192.168.1.0    255.255.255.0     192.168.1.11     192.168.1.11     10
     192.168.1.10  255.255.255.255        127.0.0.1        127.0.0.1     10
     192.168.1.11  255.255.255.255        127.0.0.1        127.0.0.1     10
    192.168.1.255  255.255.255.255     192.168.1.10     192.168.1.10     10
    192.168.1.255  255.255.255.255     192.168.1.11     192.168.1.11     10
        224.0.0.0        240.0.0.0     192.168.1.10     192.168.1.10     10
        224.0.0.0        240.0.0.0     192.168.1.11     192.168.1.11     10
  255.255.255.255  255.255.255.255     192.168.1.10     192.168.1.10      1
  255.255.255.255  255.255.255.255     192.168.1.11     192.168.1.11      1
Default Gateway:       192.168.1.5
===============================================================
Persistent Routes:
  None
===============================================================
0
 

Author Comment

by:r270ba
ID: 12350821
AH Ha!!!  

I see that my default gateway is 192.168.1.5 and should be 1.1

That fixed it...

I will split the pts b/t lrmoore for the route print and snowsurfer for telling me to check the default gateway...the reason I didn't check it to begin with is b/c you said it would be in the route print....

Thanks a bunch guys!!!
0

Featured Post

 [eBook] Windows Nano Server

Download this FREE eBook and learn all you need to get started with Windows Nano Server, including deployment options, remote management
and troubleshooting tips and tricks

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There’s a movement in Information Technology (IT), and while it’s hard to define, it is gaining momentum. Some call it “stream-lined IT;” others call it “thin-model IT.”
Unable to change the program that handles the scan event from a network attached Canon/Brother printer/scanner. This means you'll always have to choose which program handles this action, e.g. ControlCenter4 (in the case of a Brother).
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …

885 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question