I recently completed a compound project at work that included getting rid of an old firewall/router and installing a Cisco 5510 into one our company’s offices to use as a primary firewall and VPN concentrator. To save the company some money, I was also tasked with migrating an existing machine, which happened to be a xen instance running in Appnexus’s cloud, onto a physical box housed in the office also running several other Xen instances. The migration was a interesting project on it’s own and will be the subject of a blog post shortly, time permitting. Suffice it to say, things went well overall and the machine was successfully migrated. The machine has been home to the company’s public code repo for the last two years and must be kept accessible from the outside as well as by engineers on the inside network, but the DOM0 was not in the DMZ and this instance was the only instance that needed public access so I wasn’t going to move it there. Instead I decided to put the box on our local network and build a static NAT to the outside. But this provided a slightly awkward situation in regards to DNS.
Let’s say the inside network is known as inside.company.org and the repos box is known to all as repos.company.org. Obviously we need to provide a DNS entry in the inside tables so that staff can access the box by name, but what name should they use? The box previously known as repos.company.org, now becomes repos.inside.company.org, since that’s all the inside DNS server is authoritative for. I can leave it as repos.company.org and put an entry in the DNS server for company.org but it obviously can’t have the internal IP, or no one from the outside will be able to access it. So what next? Two names for the same machine, one for use from the outside the other for when you are in the office – Yuk! Even if the engineers would agree to use two names (they wouldn’t), I’d never be happy with it. I could have setup a Split Horizon dns scheme, also called a DNS View but come to find out, the ASA had a beautiful solution to my problem just waiting to be switched on.
When using a static NAT (not PAT )
Cisco has added a very clever feature. The DNS rewrite option, also know as “DNS Doctoring”, looks like this:
(note the unassuming “dns” at the end of the line)
The ASA device is inspecting every packet already, right? That’s what it does. So when DNS Rewrite is turned on for a Static NAT, it simply watches for any DNS lookups on the target of the static NAT and replaces the external IP address in the answer portion of the lookup with the inside IP of the host.
To test it:
From the outside:
; <<>> DiG 9.6.0-APPLE-P2 <<>> @4.2.2.2 repos.company.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44840
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;repos.company.org. IN A
;; ANSWER SECTION:
repos.company.org. 300 IN A XXX.XX.XXX.XX
;; Query time: 89 msec
;; SERVER: 4.2.2.2#53(4.2.2.2)
;; WHEN: Sat Feb 6 09:59:56 2010
;; MSG SIZE rcvd: 53
Querying the same Name Server from the inside:
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.1 <<>> @4.2.2.2 repos.company.org
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3528
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;repos.company.org. IN A
;; ANSWER SECTION:
repos.company.org. 300 IN A 192.168.0.16
;; Query time: 96 msec
;; SERVER: 4.2.2.2#53(4.2.2.2)
;; WHEN: Sat Feb 6 10:00:03 2010
;; MSG SIZE rcvd: 53
Problem solved!
This is one of those magical solutions that works as advertised. I wish they weren’t so rare.
DNS Rewriting is a simple and elegant solution that can save you time and energy. You can read more about it on Cisco’s website.
Recent Comments