Cisco ASA 5506-X Configuration Manual page 120

DNS and NAT
The following topics provide examples of DNS rewrite:
•
•
•
•
•
DNS Reply Modification, DNS Server on Outside
The following figure shows a DNS server that is accessible from the outside interface. A server,
ftp.cisco.com, is on the inside interface. You configure the ASA to statically translate the ftp.cisco.com
real address (10.1.3.14) to a mapped address (209.165.201.10) that is visible on the outside network.
In this case, you want to enable DNS reply modification on this static rule so that inside users who have
access to ftp.cisco.com using the real address receive the real address from the DNS server, and not the
mapped address.
When an inside host sends a DNS request for the address of ftp.cisco.com, the DNS server replies with
the mapped address (209.165.201.10). The ASA refers to the static rule for the inside server and
translates the address inside the DNS reply to 10.1.3.14. If you do not enable DNS reply modification,
then the inside host attempts to send traffic to 209.165.201.10 instead of accessing ftp.cisco.com
directly.
Cisco ASA Series Firewall CLI Configuration Guide
5-22
DNS Reply Modification, DNS Server on Outside, page 5-22
DNS Reply Modification, DNS Server, Host, and Server on Separate Networks, page 5-23
DNS Reply Modification, DNS Server on Host Network, page 5-24
DNS64 Reply Modification Using Outside NAT, page 5-25
PTR Modification, DNS Server on Host Network, page 5-27
Chapter 5 NAT Examples and Reference