Solved

DNS Redirect for webiste in DMZ \ Cisco ASA5510?

Posted on 2008-09-29
7
735 Views
Last Modified: 2012-06-21
Good Morning,

I am going to do my best to explain the issue clearly.

We have an ASA5510 Cisco Firewall.  On that firewall we have three interfaces. Outside, Inside, and DMZ.

Outside: 64.8.98.0
Inside: 172.18.0.0
DMS: 192.168.251.0

We currently have a FTP site that all of our internal and external employees\clients use.  It is on a web server on the DMZ.  The web server is a standalone Windows 2000 server the only thing loaded is IIS for the FTP site.

The website is DMZ address is 192.168.251.11 and the outside address is 64.8.98.53 and there is a static in the firewall that takes care of the outside to DMZ translation. So when people outside hit ftp://www.ourdoaminname.com they go to 64.8.98.53 and get prompt with a login box.

Outside access to the FTP site works just fine!!!!!!

The real issue is inside access.  When an internal user goes to ftp://www.ourdoaminname.com it never connects and ends up in error.  If you ping ftp://www.ourdoaminname.com you get the outside IP address not the address on the DMZ.  Now if I go to ftp://192.168.251.11 from inside I get the login prompt and I can get right into the site.  I know that our internal folks could just use the IP addresses but I have the extreme need to make this seamless.  I would like everyone to look and work the same internal and external.  Plus when I change the site later and I can just change DNS as opposed to IP addresses on 80 machines.

Is there any way to use my internal DNS server to redirect my clients to the DMZ address if so how do I do it?  Secondly if not is there something the firewall can do to perform the redirect or translation?

Thanks

John





We own a domain name name for
0
Comment
Question by:stuart100
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
7 Comments
 
LVL 7

Expert Comment

by:DBrookfield
ID: 22595530
The problem you have is you can't go out and back in through the same firewall router.

I've no idea how may people yo have, but the easy way to do this would be to edit your hosts file.  You can edit your DNS on your domain, basically you are trying to override the DNS they are getting for your FTP.

I can't remember how you would do this in windows DNS, but in your hosts file all you need do is put

192.168.251.11        ftp://www.ourdoaminname.com

And that would override what they are getting from DNS, if you see what I mean?
0
 
LVL 7

Expert Comment

by:DBrookfield
ID: 22595539
Sorry about typo's. and it is supposed to say "You can also"
0
 
LVL 71

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 22595546

> Is there any way to use my internal DNS server to redirect my clients to
> the DMZ address if so how do I do it?

Sure, that's no problem at all.

You have two choices now. Which you use depends on how you want to scope the change. I suspect the first of these will be most appropriate:

1. Open the DNS Console (from Administrative Tools)
2. Expand Forward Lookup Zones
3. Create a new zone
4. Type is either Primary or Primary and Active Directory Integrated
5. Replication Scope can remain default
6. Zone Name should be the name of the host, so: www.yourdomain.com
7. Select "Do not allow dynamic updates"
8. Finish

In step 6, naming the zone in this manner means we do not have to maintain any other public records beneath yourdomain.com unless we really need to.

Then you need to add a record so the name resolves:

1. Select the new zone (www.yourdomain.com)
2. Right click and select "New Host (A)..."
3. Leave the Name Blank
4. Enter the IP Address

Finally, it just needs testing.

On a client machine, run:

ipconfig /flushdns

Then:

nslookup www.yourdomain.com
and
ping www.yourdomain.com

It should reply with the record we just added.

HTH

Chris
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:stuart100
ID: 22595893
Chris-Dent:
Crap I was so close.  I made the Pri forward lookup like you described yesterday but when I made the Host record I did not leave the name blank.  It worked like a charm enjoy the points and thanks for not tossing down and quick answer without reading what I was looking for.

Dbrookfield:
Did you read the part in my question where I said I did not want to go around to 80 machines to change IP addresses?  The host file would have caused me to do the same thing...even if I just pushed it out to each machine it would be way more work than just changing the record on the DNS server.
0
 

Author Closing Comment

by:stuart100
ID: 31501147
Thanks for the help...
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 22595937

Glad I could help out :)

Chris
0
 
LVL 7

Expert Comment

by:DBrookfield
ID: 22603748
Apologies, I did say I didn't remember how to do this in Windows DNS, as I use bind, so I gave you a solution, I didn't see the 80 machines though,  however, the push option works well and would only have taken 5 or 10 mins..
0

Featured Post

Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Resolve DNS query failed errors for Exchange
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question