10-22
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 10 NAT Examples and Reference
DNS and NAT
The following topics provide examples of DNS rewrite:
• DNS Reply Modification, DNS Server on Outside, page 10-22
• DNS Reply Modification, DNS Server, Host, and Server on Separate Networks, page 10-23
• DNS Reply Modification, DNS Server on Host Network, page 10-24
• DNS64 Reply Modification Using Outside NAT, page 10-25
• PTR Modification, DNS Server on Host Network, page 10-27
DNS Reply Modification, DNS Server on Outside
The following figure shows a DNS server that is accessible from the outside interface. A server,
ftp.cisco.com, is on the inside interface. You configure the ASA to statically translate the ftp.cisco.com
real address (10.1.3.14) to a mapped address (209.165.201.10) that is visible on the outside network.
In this case, you want to enable DNS reply modification on this static rule so that inside users who have
access to ftp.cisco.com using the real address receive the real address from the DNS server, and not the
mapped address.
When an inside host sends a DNS request for the address of ftp.cisco.com, the DNS server replies with
the mapped address (209.165.201.10). The ASA refers to the static rule for the inside server and
translates the address inside the DNS reply to 10.1.3.14. If you do not enable DNS reply modification,
then the inside host attempts to send traffic to 209.165.201.10 instead of accessing ftp.cisco.com
directly.
To Next Page
Loading...
Need help?
General