[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

PIX DNS, NAT, DMZ

Posted on 2007-08-10
3
Medium Priority
?
437 Views
Last Modified: 2010-04-09
Guru's

We have 6 office across the globe, with various PIX's (506, 501, 515), VPNs between offices and Active Directory Integrated DNS.  I'll be installing a new web server into the head office network on the ASA 5510's DMZ port and adding the server name to DNS which will be replicated to all offices.

Network info:
Head office 192.168.10.0/24
Web server DMZ 172.16.1.10
US office 192.168.11.0/24

My question relates to DNS; if an international user connects to his local office with his Cisco client and attempts to connect to the web server he won't be able to reach it as 'his' PIX gives out DNS servers on his network.  As such he wouldn't be able to route to it.

Previosuly I have evaded this issue with hosts file entries and gotten away with it as the server was externally hosted to all offices (inc head office) but now the server is moving I can't use hosts files since a US visitor to the head office could not readch the web server on its external address from inside head office.

I trust this makes sense...?

Thanks muchly
0
Comment
Question by:jasonhamlett
  • 2
3 Comments
 
LVL 71

Accepted Solution

by:
Chris Dent earned 2000 total points
ID: 19668864

Hi,

Before continuing I'd like to make sure I understand properly.

  - Head Office: Access Web Server on Internal IP. Cannot reach server on External
  - Branch Offices: Access Web Server on External IP. Cannot reach server on Internal

If that's correct then we need to look at your DNS infrastructure slightly.

Is the Domain Name for the Web Site different from the Active Directory Domain Name?

Each Branch Office uses a DNS Server local to it? And the Head Office uses it's own local DNS server as well?

If we're doing well so far then there's fortunately a fairly simple answer to the problem.

1. On DNS Server for Head Office:
 - Create a Forward Lookup Zone with the name of the website (e.g. www.yourdomain.com).
 - Set as Primary, but not AD Integrated
 - Do Not Enable Dynamic Updates
 - Delete any Host(A) Records
 - Add a Host(A) Record with a Blank Name pointing to the Internal IP Address of the Web Server

2. On DNS Servers for Branch Offices:
 - Create a Forward Lookup Zone with the name of the website (e.g. www.yourdomain.com).
 - Set as Primary, but not AD Integrated
 - Do Not Enable Dynamic Updates
 - Delete any Host(A) Records
 - Add a Host(A) Record with a Blank Name pointing to the External IP Address of the Web Server

The reason for using the full name of the web site is that it allows you to create an internal record for a single name. Avoiding any issues for resolution of any other hosts within the Domain.

HTH

Chris
0
 

Author Comment

by:jasonhamlett
ID: 19669009
Chris - You da man... points on their way...
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 19669638

You're welcome :)

Chris
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses
Course of the Month19 days, 22 hours left to enroll

873 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question