Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

issues getting dns forwards through pix firewall

Posted on 2007-08-07
8
Medium Priority
?
255 Views
Last Modified: 2013-11-05
We have a pix 501 behind a cisco router and are trying to set up internal dns with forwarding for external requests.  

The layout looks like this  

 INTERNET -> CIsco 1840 -> Pix 501 -> Switch -> Lan worstations

The DNS server is on the same subnet and switch as the workstations (192.168)

Im not sure if i need to configure anything specifically to pass DNS requests but if i configure a client directly with the ISP DNS server, it works fine.  But when our internal DNS server tries to forward queries, it fails.  

On the firewall log I see the following:

"106023: Deny udp src outside:64.105.132.250/53 dst inside:10.0.3.2/3448 by access-group "server_access" "

But i already have the access list of


PrivateFW# sh access-list
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 256)
            alert-interval 300
access-list server_access; 5 elements
access-list server_access line 1 permit tcp host 10.0.2.122 host 192.168.100.69 eq 3306 (hitcnt=0)
access-list server_access line 2 permit icmp any any (hitcnt=1195)
access-list server_access line 3 permit udp host 64.105.132.250 10.0.3.0 255.255.255.0 eq dnsix (hitcnt=0)
access-list server_access line 4 permit udp host 64.105.132.250 10.0.3.0 255.255.255.0 eq domain (hitcnt=0)
access-list server_access line 5 permit udp host 64.105.172.27 10.0.3.0 255.255.255.0 eq domain (hitcnt=0)

0
Comment
Question by:rivetgeek
  • 4
  • 4
8 Comments
 

Author Comment

by:rivetgeek
ID: 19649894
Forgot to add,

64.105.132.250 is ISP's DNS Server

10.0.3.2 is outside interface ip of firewall which connects to router
0
 
LVL 17

Expert Comment

by:mikecr
ID: 19649972
What are you using for a DNS server, Microsoft?
0
 

Author Comment

by:rivetgeek
ID: 19649985
Yes.  MIcrosoft Server 2000.  No AD though
0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
LVL 17

Expert Comment

by:mikecr
ID: 19650085
You're DNS is not set up properly then. When you edit the properties of your DNS, does it show you the root hints? A default install of DNS on a Microsoft 2000 server uses it's root hints to resolve names on the internet. When the server is configured to look at itself for DNS, does it have the same problem? Have you verified that the DNS service is running?
0
 

Author Comment

by:rivetgeek
ID: 19650119
The DNS is working for internal hosts.  In the properties, the forwardings are set to the ISPs DNS servers.

I created zones for all our web sites domain names and hosts such as www, dev, admin etc to reach them internally via dev.domainname.com or www.domainname.com.

The forwardings should forward queries that the local DNS server doesn't have a zone for to the ISP DNS.

So if i have a zone for ABC.com and a host for www,  I can set my workstation dns to point to the internal DNS server and get to www.ABC.com.  However if I try to then get to google.com, for instance, it cant resolve the name.  

I am under the impression that the firewall log file indicates it is blocking the DNS response from the ISP DNS server
0
 
LVL 17

Accepted Solution

by:
mikecr earned 2000 total points
ID: 19650170
You shouldn't have to set up DNS forwarding to your ISP. Your root hints will help you resolve them. All your doing is sending your DNS request to your ISP who, if it doesn't have the zone on it will use it's root hints to forward you on anyhow. You need to make sure TCP/UDP Port 53 is open on your firewall which might be causing the problem also. I'm suspecting though that your DNS isn't correct, that's why it works on the workstations but not when using the server.

Right click on your computers name in DNS and choose properties. Click on your Root Hints tab and see if they show up.
0
 

Author Comment

by:rivetgeek
ID: 19650264
This wasn't exactly the issue but it seems there were some funky settings so i killed it all and started over configuring it and it worked fine.

Thanks.
0
 
LVL 17

Expert Comment

by:mikecr
ID: 19652875
Great! Glad to see it's working! Have a good day!
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When speed and performance are vital to revenue, companies must have complete confidence in their cloud environment.
As managed cloud service providers, we often get asked to intervene when cloud deployments go awry. Attracted by apparent ease-of-use, flexibility and low computing costs, companies quickly adopt leading public cloud platforms such as Amazon Web Ser…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

580 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question