DNS Redirect for webiste in DMZ \ Cisco ASA5510?

Good Morning,

I am going to do my best to explain the issue clearly.

We have an ASA5510 Cisco Firewall.  On that firewall we have three interfaces. Outside, Inside, and DMZ.

Outside: 64.8.98.0
Inside: 172.18.0.0
DMS: 192.168.251.0

We currently have a FTP site that all of our internal and external employees\clients use.  It is on a web server on the DMZ.  The web server is a standalone Windows 2000 server the only thing loaded is IIS for the FTP site.

The website is DMZ address is 192.168.251.11 and the outside address is 64.8.98.53 and there is a static in the firewall that takes care of the outside to DMZ translation. So when people outside hit ftp://www.ourdoaminname.com they go to 64.8.98.53 and get prompt with a login box.

Outside access to the FTP site works just fine!!!!!!

The real issue is inside access.  When an internal user goes to ftp://www.ourdoaminname.com it never connects and ends up in error.  If you ping ftp://www.ourdoaminname.com you get the outside IP address not the address on the DMZ.  Now if I go to ftp://192.168.251.11 from inside I get the login prompt and I can get right into the site.  I know that our internal folks could just use the IP addresses but I have the extreme need to make this seamless.  I would like everyone to look and work the same internal and external.  Plus when I change the site later and I can just change DNS as opposed to IP addresses on 80 machines.

Is there any way to use my internal DNS server to redirect my clients to the DMZ address if so how do I do it?  Secondly if not is there something the firewall can do to perform the redirect or translation?

Thanks

John





We own a domain name name for
stuart100Asked:
Who is Participating?
 
Chris DentConnect With a Mentor PowerShell DeveloperCommented:

> Is there any way to use my internal DNS server to redirect my clients to
> the DMZ address if so how do I do it?

Sure, that's no problem at all.

You have two choices now. Which you use depends on how you want to scope the change. I suspect the first of these will be most appropriate:

1. Open the DNS Console (from Administrative Tools)
2. Expand Forward Lookup Zones
3. Create a new zone
4. Type is either Primary or Primary and Active Directory Integrated
5. Replication Scope can remain default
6. Zone Name should be the name of the host, so: www.yourdomain.com
7. Select "Do not allow dynamic updates"
8. Finish

In step 6, naming the zone in this manner means we do not have to maintain any other public records beneath yourdomain.com unless we really need to.

Then you need to add a record so the name resolves:

1. Select the new zone (www.yourdomain.com)
2. Right click and select "New Host (A)..."
3. Leave the Name Blank
4. Enter the IP Address

Finally, it just needs testing.

On a client machine, run:

ipconfig /flushdns

Then:

nslookup www.yourdomain.com
and
ping www.yourdomain.com

It should reply with the record we just added.

HTH

Chris
0
 
DBrookfieldCommented:
The problem you have is you can't go out and back in through the same firewall router.

I've no idea how may people yo have, but the easy way to do this would be to edit your hosts file.  You can edit your DNS on your domain, basically you are trying to override the DNS they are getting for your FTP.

I can't remember how you would do this in windows DNS, but in your hosts file all you need do is put

192.168.251.11        ftp://www.ourdoaminname.com

And that would override what they are getting from DNS, if you see what I mean?
0
 
DBrookfieldCommented:
Sorry about typo's. and it is supposed to say "You can also"
0
Improved Protection from Phishing Attacks

WatchGuard DNSWatch reduces malware infections by detecting and blocking malicious DNS requests, improving your ability to protect employees from phishing attacks. Learn more about our newest service included in Total Security Suite today!

 
stuart100Author Commented:
Chris-Dent:
Crap I was so close.  I made the Pri forward lookup like you described yesterday but when I made the Host record I did not leave the name blank.  It worked like a charm enjoy the points and thanks for not tossing down and quick answer without reading what I was looking for.

Dbrookfield:
Did you read the part in my question where I said I did not want to go around to 80 machines to change IP addresses?  The host file would have caused me to do the same thing...even if I just pushed it out to each machine it would be way more work than just changing the record on the DNS server.
0
 
stuart100Author Commented:
Thanks for the help...
0
 
Chris DentPowerShell DeveloperCommented:

Glad I could help out :)

Chris
0
 
DBrookfieldCommented:
Apologies, I did say I didn't remember how to do this in Windows DNS, as I use bind, so I gave you a solution, I didn't see the 80 machines though,  however, the push option works well and would only have taken 5 or 10 mins..
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.