Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

​My lab network topology with an asa firewall is as follows

10.10.10.20 --> ASA ---> 192.168.1.10 --> external website

I want a client with the ip address 10.10.10.20 to access external websites so i set up nat

nat (inside,outside) static 192.168.1.10

and access list

access-list outside-acl extended permit tcp any host 10.10.10.20 eq www 
access-list outside-acl extended permit tcp any host 10.10.10.20 eq domain 

access-list inside-acl extended permit tcp 10.10.10.0 255.255.255.0 any eq www 
access-list inside-acl extended permit tcp 10.10.10.0 255.255.255.0 any eq domain

access-group outside-acl in interface outside
access-group inside-acl in interface inside

when I access a website with its domain name it can't access it but I access website with ip address it works - how do I fix this?

share|improve this question

1 Answer 1

Based on the guidelines you have provided, you do not need the outside-acl ruleset. Just use these on the inside.

I am making the assumption that your DNS is located on the 192.168.1.0/24 side. Note that without more information, it's difficult to lock down DNS rulesets so I opened them as 53/udp to all addresses. DNS resolvers iteratively query different authoritative hosts until they find the correct DNS server, so just leave DNS open for now.

access-list inside-acl extended permit tcp 10.10.10.0 255.255.255.0 any eq www 
! I am assuming your DNS is somewhere on the 10.10.10.x side
access-list inside-acl extended permit tcp 10.10.10.0 255.255.255.0 any eq domain
access-list inside-acl extended permit udp 10.10.10.0 255.255.255.0 any eq domain

access-group inside-acl in interface inside

As far as your nat statement, the syntax you included isn't correct, but I'm assuming you did something like this

static (inside,outside) 192.168.1.10 10.10.10.0 netmask 255.255.255.0
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.