Solved

PIX WAN Interface access by FQDN

Posted on 2006-06-15
22
480 Views
Last Modified: 2008-03-10
I am not able to access www.mydomain.com which points to the public ip assigned to the WAN interface of the PIX from inside the network.  How can i resolve this?
0
Comment
Question by:andreacadia
  • 10
  • 9
22 Comments
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
You can't.
Assuming that you have a static nat mapping port 80 from the outside interface to an inside host, you have no choice except to resolve www.mydomain.com interanally to the private IP address.

Unless - your DNS server is located outside the pix and the dns request for www.mydomain.com passes through the firewall, then you can use "alias" or dns fixup.

static (inside,outside) tcp interface http 192.168.111.222 http dns netmask 255.255.255.255
                                                                                           ^^^

0
 

Author Comment

by:andreacadia
Comment Utility
Correction, mydomain.com points to an IP that has a one to one translation configured on the PIX, not the IP asssigned to the PIX WAN. The ip is static natted back to my webserver...
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
Doesn't matter. Same issue.
0
 

Author Comment

by:andreacadia
Comment Utility
Can you clarify everything after "unless"
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
What do your internal hosts use for their DNS server? Is it an internal server, or public server?
If it is internal, then you should resolve to the private IP address.
If it is an external dns server, the PIX will intercept the dns request and "doctor" the response to the real private IP address. This is done with "alias" command on previous versions, but with the "dns" keyword in the static xlate for the latest versions of PIX OS.
0
 

Author Comment

by:andreacadia
Comment Utility
so in your example above the "192.168.111.222" is internal hos that my static nat points to?  Also, would this require an accompany access list statement?

how would the static nat look if it was applied to an available ip and not the WAN interface IP?
0
 

Author Comment

by:andreacadia
Comment Utility
sorry, my hosts use dns servers provided by the ISP.
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
then try using the "dns" in the static as I demonstrated above
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
Comment Utility
static (inside,outside) tcp <external ip> http <internal ip> http dns netmask 255.255.255.255
access-list outside_in permit tcp any host <external ip> eq http
access-group outside_in in interface outside
0
 

Author Comment

by:andreacadia
Comment Utility
my existing static looks like this:

static (inside, outside) <public_ip> <private_ip> net mask 255.255.255.255 0 0
access-list in permit ip any host <public_ip>

where <public_ip> is not the IP assigned to PIX outside interface.

based on your last comment i should edit my config to look like this?:

static (inside, outside) <public_ip> <private_ip> DNS net mask 255.255.255.255 0 0


0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
Exactly..
except that "nat mask" is one word "netmask", and I think that "DNS" needs to be lowercase "dns"
0
 

Author Comment

by:andreacadia
Comment Utility
ok, i was just capitalzing "DNS" for emphasis..i will try this and let you know the result.
Thanks.
0
 

Author Comment

by:andreacadia
Comment Utility
the change above did not seem to have any effect..
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
Where is the DNS server physically in relation to the PIX FW?
Inside, or outside?
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
Oh... did you flushdns from your client? It might have been in cache?
C:\>ipconfig/flushdns
0
 

Author Comment

by:andreacadia
Comment Utility
for most of the network the DNS servers are outside of the PIX as they use the ISP's DNS server.  There is an additional subnet behind the PIX (one hop from the PIX lan network) whose gateway gets Natted to the additional Public IP of the PIX. On this additional subnet, a windows domain exists with a single domain controller that is also a dns server.
0
 

Author Comment

by:andreacadia
Comment Utility
i tried flushing the dns cache to no avail.
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
What version PIX OS?
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
Question asked was answered -
"you can't" is a perfectly acceptible answer.
0
 
LVL 51

Expert Comment

by:Keith Alabaster
Comment Utility
Point taken and thanks for highlighting it. My error in not realising that the rest of thread was secondary.

Thanks
Keith
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Suggested Solutions

This is about downgrading PIX Version 8.0(4) & ASDM 6.1(5) to PIX 7.2(4) and ASDM 5.2(4) but with only 64MB RAM and 16MB flash. Background: You have a Cisco Pix 515E which was running on PIX 7.2(4) and its supporting ASDM 5.2(4) without any i…
From Cisco ASA version 8.3, the Network Address Translation (NAT) configuration has been completely redesigned and it may be helpful to have the syntax configuration for both at a glance. You may as well want to read official Cisco published AS…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now