Cisco ASA 5512-X Configuration Guide

10-25
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 10 NAT Examples and Reference
DNS and NAT
Figure 10-20 DNS Reply Modification, DNS Server on Host Network
Procedure
Step 1 Create a network object for the FTP server.
hostname(config)# object network FTP_SERVER
hostname(config-network-object)# host 209.165.201.10
Step 2 Configure static NAT with DNS modification.
hostname(config-network-object)# nat (outside,inside) static 10.1.2.56 dns
DNS64 Reply Modification Using Outside NAT
The following figure shows an FTP server and DNS server on the outside IPv4 network. The ASA has a
static translation for the outside server. In this case, when an inside IPv6 user requests the address for
ftp.cisco.com from the DNS server, the DNS server responds with the real address, 209.165.200.225.
Because you want inside users to use the mapped address for ftp.cisco.com (2001:DB8::D1A5:C8E1)
you need to configure DNS reply modification for the static translation. This example also includes a
static NAT translation for the DNS server, and a PAT rule for the inside IPv6 hosts.
ftp.cisco.com
209.165.201.10
DNS Server
Outside
Inside
User
10.1.2.27
Static Translation on Inside to:
10.1.2.56
130022
1
2
7
6
5
4
3
DNS Query
ftp.cisco.com?
DNS Reply
209.165.201.10
DNS Reply Modification
209.165.201.10 10.1.2.56
DNS Reply
10.1.2.56
FTP Request
209.165.201.10
Dest Addr. Translation
209.165.201.1010.1.2.56
FTP Request
10.1.2.56
Security
Appliance

Cisco ASA 5512-X Specifications

General

Brand	Cisco
Model	ASA 5512-X
Category	Firewall
Language	English