Cisco 6500 - Catalyst Series 10 Gigabit EN Interface Module Expansion, Configuration Manual, Page: 438 / 742

22-22
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Chapter 22 Applying Application Layer Protocol Inspection
DNS Inspection
hostname(config)# access-group 101 in interface outside
This configuration requires the following A-record on the DNS server:
server.example.com. IN A 209.165.200.225
DNS Rewrite with Three NAT Zones
Figure 22-5 illustrates a more complex scenario: how DNS inspection allows NAT to operate
transparently with a DNS server with minimal configuration. For configuration instructions for scenarios
like this one, see the
“Configuring DNS Rewrite with Three NAT Zones” section on page 22-23 .
Figure 22-5 DNS Rewrite with Three NAT Zones
In Figure 22-5 , a web server, server.example.com, has the real address 192.168.100.10 on the DMZ
interface of the FWSM. A web client with the IP address 10.10.10.25 is on the inside interface and a
public DNS server is on the outside interface. The site NAT policies are as follows:
•
The outside DNS server holds the authoritative address record for server.example.com.
• Hosts on the outside network can contact the web server with the domain name server.example.com
through the outside DNS server or with the IP address 209.165.200.225.
•
Clients on the inside network can access the web server with the domain name server.example.com
through the outside DNS server or with the IP address 192.168.100.10.
When a host or client on any interface accesses the DMZ web server, it queries the public DNS server
for the A-record of server.example.com. The DNS server returns the A-record showing that
server.example.com binds to address 209.165.200.225.
When a web client on the outside network attempts to access http://server.example.com, the sequence of
events is as follows:
1. The host running the web client sends the DNS server a request for the IP address of
server.example.com.
132973
Web client
10.10.10.25
Web server
192.168.100.10
DNS server
server.example.com IN A 209.165.200.225
Outside
DMZ
192.168.100.1
10.10.10.1
Inside
10.99.99.2
FWSM