0
votes
0answers
64 views

Cisco DNS Inspection disallows Reverse Lookup

I'm trying to use DNS Doctoring on my ASA 5505, but apparenly DNS Doctoring required DNS Inspection, and DNS Inspection forbids reverse lookup requests?! How do work around this? I did find this: ...
3
votes
1answer
542 views

How should DNS be configured for remote VPN access to a Windows Domain?

Suppose you have a small windows domain configured as follows: domain name is ad.example.com (as per these guidelines) DC1 is at 10.10.10.3 DC2 is at 10.10.10.4 DC1 and DC2 are running the ...
1
vote
2answers
237 views

Cisco ASA 5505: Reach outside DNS address from inside

We use a Cisco ASA 5505 at our company. We have a dns A record (home.company.com) pointing to the external IP. In the ASA 5505 the http-port (80) is forwarded to an inside web server. No problem ...
1
vote
1answer
174 views

Accessing external site over DNS fails, acess through IP address works with a cisco asa

​My lab network topology with an asa firewall is as follows 10.10.10.20 --> ASA ---> 192.168.1.10 --> external website I want a client with the ip address 10.10.10.20 to access external websites ...
0
votes
1answer
621 views

How to block DNS request from inside host with ASA 5505

This seemed simple enough but I have to be missing something. I have the following config to block all DNS request from the inside that are not going to the allowed external DNS server. access-list ...
1
vote
1answer
615 views

Redirect all DNS request with ASA5505 to one specific DNS server

I want to make it so if a user tries to use a different DNS server the request will be redirected to the one they should be using. Looks like this might work: ip access-list extended transparent_dns ...
0
votes
2answers
533 views

Cisco ASA and Exchange Email Flow (maybe a DNS issue?)

I swapped over from SonicWall to a Cisco ASA. Everything seemed to work except now some of my Exchange email gets stuck in the external queues. I get errors 421 4.4.2 Connection Dropped and 451 ...
1
vote
1answer
995 views

Cisco ASA logs “regular translation creation failed for icmp” for client DNS traffic

I am having an issue similar to Cisco ASA logs "regular translation creation failed for icmp …" for DNS traffic, yet it works however in my situation the source is a MacBook Pro (10.7) not running ...
1
vote
2answers
722 views

How to disable dns doctoring for IPSEC VPN connections for ASA 5510

*Update, turns out that adding additional nat exclusions stopped dns doctoring from being triggered, resolving the problem. So I have one last outstanding issue with our vpn setup to our office. I ...
0
votes
1answer
213 views

Basic ASA 5505/DHCP/Routing Help

I have been given the task of bringing multiple development servers currently living a mile away in-house and configuring the network to accommodate them. I've done little more than stick jack A into ...
8
votes
3answers
12k views

How do I reach my internal server on the external IP?

We are trying to configure our Cisco 5505, and it has been done through ASDM. There is one big problem that we're not able to solve, and that's when you go from inside to outside and back in again. ...
2
votes
1answer
469 views

Windows XP clients do not update server 2008 DNS forward lookup zone

I have a Cisco 5505 working as a DHCP server, and a server 2008 DNS server running an AD domain. I am having problems with all XP computers not updating the forward lookup zone. The reverse lookup ...
2
votes
4answers
12k views

VPN is working, except for DNS lookups. Firewall (Cisco ASA 5505) issue?

I've got the following set up: LAN -> DHCP / DNS / VPN server (OSX 10.6) -> Cisco ASA 5505 -> WAN Connecting to the LAN via VPN works fine. I get all the details properly and I can ping ...
1
vote
3answers
2k views

ASA 5505 :: Routed/NAT or Transparent mode for inside Web/DNS Server

I just bought an ASA 5505 that my data center is setting up for me. They have told me that setting the ASA to routed with NAT will break Web/DNS server on inside network. For example: WAN IP ...
0
votes
1answer
2k views

Is it possible to do DNS-based ACLs on a Cisco ASA?

Short of using static IP addresses, is it possible to have a Cisco ASA use a DNS name rather than an IP address? For instance, if I want to limit a host in the DMZ to access only one particular web ...
3
votes
3answers
11k views

Cisco ASA logs “regular translation creation failed for icmp …” for DNS traffic, yet it works

Every few minutes our Cisco ASA 5505 firewall is logging errors that I can't figure out with my limited Cisco experience. Severity Date Time Syslog ID Source IP Destination IP ...