Solved

DNS Redirect for webiste in DMZ \ Cisco ASA5510?

Posted on 2008-09-29
7
728 Views
Last Modified: 2012-06-21
Good Morning,

I am going to do my best to explain the issue clearly.

We have an ASA5510 Cisco Firewall.  On that firewall we have three interfaces. Outside, Inside, and DMZ.

Outside: 64.8.98.0
Inside: 172.18.0.0
DMS: 192.168.251.0

We currently have a FTP site that all of our internal and external employees\clients use.  It is on a web server on the DMZ.  The web server is a standalone Windows 2000 server the only thing loaded is IIS for the FTP site.

The website is DMZ address is 192.168.251.11 and the outside address is 64.8.98.53 and there is a static in the firewall that takes care of the outside to DMZ translation. So when people outside hit ftp://www.ourdoaminname.com they go to 64.8.98.53 and get prompt with a login box.

Outside access to the FTP site works just fine!!!!!!

The real issue is inside access.  When an internal user goes to ftp://www.ourdoaminname.com it never connects and ends up in error.  If you ping ftp://www.ourdoaminname.com you get the outside IP address not the address on the DMZ.  Now if I go to ftp://192.168.251.11 from inside I get the login prompt and I can get right into the site.  I know that our internal folks could just use the IP addresses but I have the extreme need to make this seamless.  I would like everyone to look and work the same internal and external.  Plus when I change the site later and I can just change DNS as opposed to IP addresses on 80 machines.

Is there any way to use my internal DNS server to redirect my clients to the DMZ address if so how do I do it?  Secondly if not is there something the firewall can do to perform the redirect or translation?

Thanks

John





We own a domain name name for
0
Comment
Question by:stuart100
  • 3
  • 2
  • 2
7 Comments
 
LVL 7

Expert Comment

by:DBrookfield
Comment Utility
The problem you have is you can't go out and back in through the same firewall router.

I've no idea how may people yo have, but the easy way to do this would be to edit your hosts file.  You can edit your DNS on your domain, basically you are trying to override the DNS they are getting for your FTP.

I can't remember how you would do this in windows DNS, but in your hosts file all you need do is put

192.168.251.11        ftp://www.ourdoaminname.com

And that would override what they are getting from DNS, if you see what I mean?
0
 
LVL 7

Expert Comment

by:DBrookfield
Comment Utility
Sorry about typo's. and it is supposed to say "You can also"
0
 
LVL 70

Accepted Solution

by:
Chris Dent earned 500 total points
Comment Utility

> Is there any way to use my internal DNS server to redirect my clients to
> the DMZ address if so how do I do it?

Sure, that's no problem at all.

You have two choices now. Which you use depends on how you want to scope the change. I suspect the first of these will be most appropriate:

1. Open the DNS Console (from Administrative Tools)
2. Expand Forward Lookup Zones
3. Create a new zone
4. Type is either Primary or Primary and Active Directory Integrated
5. Replication Scope can remain default
6. Zone Name should be the name of the host, so: www.yourdomain.com
7. Select "Do not allow dynamic updates"
8. Finish

In step 6, naming the zone in this manner means we do not have to maintain any other public records beneath yourdomain.com unless we really need to.

Then you need to add a record so the name resolves:

1. Select the new zone (www.yourdomain.com)
2. Right click and select "New Host (A)..."
3. Leave the Name Blank
4. Enter the IP Address

Finally, it just needs testing.

On a client machine, run:

ipconfig /flushdns

Then:

nslookup www.yourdomain.com
and
ping www.yourdomain.com

It should reply with the record we just added.

HTH

Chris
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 

Author Comment

by:stuart100
Comment Utility
Chris-Dent:
Crap I was so close.  I made the Pri forward lookup like you described yesterday but when I made the Host record I did not leave the name blank.  It worked like a charm enjoy the points and thanks for not tossing down and quick answer without reading what I was looking for.

Dbrookfield:
Did you read the part in my question where I said I did not want to go around to 80 machines to change IP addresses?  The host file would have caused me to do the same thing...even if I just pushed it out to each machine it would be way more work than just changing the record on the DNS server.
0
 

Author Closing Comment

by:stuart100
Comment Utility
Thanks for the help...
0
 
LVL 70

Expert Comment

by:Chris Dent
Comment Utility

Glad I could help out :)

Chris
0
 
LVL 7

Expert Comment

by:DBrookfield
Comment Utility
Apologies, I did say I didn't remember how to do this in Windows DNS, as I use bind, so I gave you a solution, I didn't see the 80 machines though,  however, the push option works well and would only have taken 5 or 10 mins..
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

Hello to you all, I hear of many people congratulate AWS (Amazon Web Services) on how easy it is to spin up and create new EC2 (Elastic Compute Cloud) instances, but then fail and struggle to connect to them using simple tools such as SSH (Secure…
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now