Cisco ASA 5506-X Configuration Manual page 121

Chapter 5 NAT Examples and Reference
Figure 5-18
3
DNS Reply Modification
209.165.201.10
Procedure
Create a network object for the FTP server.
Step 1
hostname(config)# object network FTP_SERVER
hostname(config-network-object)# host 10.1.3.14
Configure static NAT with DNS modification.
Step 2
hostname(config-network-object)# nat (inside,outside) static 209.165.201.10 dns
DNS Reply Modification, DNS Server, Host, and Server on Separate Networks
The following figure shows a user on the inside network requesting the IP address for ftp.cisco.com,
which is on the DMZ network, from an outside DNS server. The DNS server replies with the mapped
address (209.165.201.10) according to the static rule between outside and DMZ even though the user is
not on the DMZ network. The ASA translates the address inside the DNS reply to 10.1.3.14.
DNS Reply Modification, DNS Server on Outside
1
DNS Query
ftp.cisco.com?
2
DNS Reply
209.165.201.10
10.1.3.14
4
DNS Reply
10.1.3.14
DNS Server
Outside
Security
Appliance
Inside
ftp.cisco.com
User
10.1.3.14
Static Translation
on Outside to:
209.165.201.10
5
FTP Request
10.1.3.14
Cisco ASA Series Firewall CLI Configuration Guide
DNS and NAT
5-23