Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just bought an ASA 5505 that my data center is setting up for me. They have told me that setting the ASA to routed with NAT will break Web/DNS server on inside network.

For example: WAN IP 66.xxx.47.x translated to LAN IP 192.168.0.1 on inside network will not provide WAN IP to the inside Web/DNS server, which apparently will break DNS -- of course DC provides no other details.

Are most people providing web services behind an ASA set in Transparent mode?? Looks like transient mode has some drawbacks, not terminating VPN traffic being one of them.

Seems like routed/NAT is the most secure/versatile, but maybe I'm not seeing the benefits of transient mode, on the surface, seems like a quick & dirty way to get up & running, hopefully more than that.

Feedback appreciated, I have to make the call on this soon...

Thanks!

share|improve this question

3 Answers 3

up vote 2 down vote accepted

A typical static entry looks like this:

static (inside,outside) 66.1.47.1 192.168.0.2 netmask 255.255.255.255

If they program it through ASDM, it'll typically throw in the dns part. This alters DNS replies coming from the outside. This is NOT what you want:

static (inside,outside) 66.1.47.1 192.168.0.2 netmask 255.255.255.255 dns

Get rid of that DNS statement and you should be fine

Transparent mode is pretty nice, but it removes a bunch of features from the ASA. Go with routed mode unless you have a reason to do otherwise.

share|improve this answer
    
agreed Jason, I want to utilize available ASA features and not be restricted. The setup is: uplink >> firewall >> switch >> backup & ESXi server. I would think that even in routed/NAT that inside would know the external IP it is "receiving", and that DNS server would know it has X external IP range available to it. I just bought SMARTnet, data center is not terribly helpful, despite $120/hour "advanced support" fee. –  virtualeyes Jul 27 '10 at 21:16
    
Smartnet is a wise investment. Cisco support is expensive, but it's damn good. I've never had better experience with large companies than I do with Cisco's TAC. –  Jason Berg Jul 27 '10 at 21:34
    
I am going to find out, Jason, will be giving TAC a call, and hopefully set up the ASA in routed mode/NAT without shelling out $120/hr to a DC that seems not to know what they're talking about... –  virtualeyes Jul 27 '10 at 22:48

ASA static entries let you use a "dns" manipulator which will rewrite the DNS response on the fly. If they are saying this is not possible they do not know what they are doing with the ASA.

share|improve this answer
    
could be true, hope not given the hefty billing. I think they are saying that in NAT internal servers do not know of the external IP range, just the NAT'd internal IP range. –  virtualeyes Jul 27 '10 at 22:11

It depends on what kind of DNS setup you have.

We have our DNS servers and web servers behind an ASA 5510 using NAT.

On the DNS server (BIND), we provide different information depending on which IP address the request comes from. This is Split-horizon DNS.

If the request comes from inside, we reply with an internal IP.

If the request comes from outside, we reply with an external IP.

For example, if the request comes from a normal outside host, we reply with the 66.xxx.47.x IP of the webserver. However, if an internal host requests the IP, we reply with the 192.168.0.x IP of the webserver.

Basically, it's completely possible to put your DNS and webservers behind an ASA using NAT as long as you configure your DNS server properly.

share|improve this answer
    
Dave, good, so to confirm, you are in routed mode and are using NAT? We are running ESXi and have a /27 IP block to work with. Based on replies thus far, routed mode with NAT seems to be the preferred solution, while, by omission, Transparent mode seems to be what you do when NAT solution is not possible. Looks like in NAT internal servers have access to the originating global IP request; if that's the case, I don't see why the DC is saying that NAT will break the inside DNS. –  virtualeyes Jul 27 '10 at 22:25
    
Right. We also have a /27 going through our ASA 5510 in routed mode using NAT. Our servers use static NAT mappings from inside to outside IPs. I can also confirm that our Apache webservers behind the ASA can see the original outside IP addresses. –  Dave Jul 27 '10 at 23:34
    
awesome, just need to know the originating outside IP. Maybe DC engineer is saying that NAT with static IP ranges is not going to work (since I'm looking to break my /27 up into a few different block ranges, 1 to backup server, and 4 to production ESXi server with 2X dual port NICs). Could also be the switch between the ASA and servers, don't know, none of this seems terribly complex, pretty basic setup... –  virtualeyes Jul 28 '10 at 0:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.