Cisco Systems DNS and NAT

3-28
Cisco ASA Series Firewall CLI Configuration Guide
Chapter3 Informatio n About NAT
DNS and NAT
! Use twice NAT to pass traffic between the inside network and the VPN client without
! address translation (identity NAT), w/route-lookup:
nat (outside,inside) source static vpn_local vpn_local destination static inside_nw
inside_nw route-lookup
Troubleshooting NAT and VPN
See the following monitoring tools for troubleshooting NAT issues with VPN:
•Packet tracer—When used correctly, a packet tracer shows which NAT rules a packet is hitting.
•show nat detail—Shows hit counts and untranslated traffic for a given NAT rule.
•show conn all—Lets you see active connections including to and from the box traffic.
To familiarize yourself with a non-working configuration vs. a working configuration, you can perform
the following steps:
1. Configure VPN without identity NAT.
2. Enter show nat detail and show conn all.
3. Add the identity NAT configuration.
•Repeat show nat detail and show conn all.
DNS and NAT
You might need to configure the ASA to modify DNS replies by replacing the address in the reply with
an address that matches the NAT configuration. You can configure DNS modification when you
configure each translation rule.
This feature rewrites the address in DNS queries and replies that match a NAT rule (for example, the A
record for IPv4, the AAAA record for IPv6, or the PTR record for reverse DNS queries). For DNS replies
traversing from a mapped interface to any other interface, the record is rewritten from the mapped value
to the real value. Inversely, for DNS replies traversing from any interface to a mapped interface, the
record is rewritten from the real value to the mapped value.
Note DNS rewrite is not applicable for PAT because multiple PAT rules are applicable for each A-record, and
the PAT rule to use is ambiguous.
Note If you configure a twice NAT rule, you cannot configure DNS modification if you specify the source
address as well as the destination address. These kinds of rules can potentially have a different
translation for a single address when going to A vs. B. Therefore, the ASA cannot accurately match the
IP address inside the DNS reply to the correct twice NAT rule; the DNS reply does not contain
information about which source/destination address combination was in the packet that prompted the
DNS request.
Note This feature requires DNS application inspection to be enabled, which it is by default. See the “DNS
Inspection” section on page 10-1 for more information.