Cisco ASA PAT with DNS rewrites

[Crusty]

Is it possible? It doesn't seem to be working, but it's possible I don't have the right configuration.

I've got a web server using PAT on port 80 to our outside interfaces IP, but DNS requests that return don't change the IP to reflect the internal IP. I'm guessing it has to do with using PAT instead of NAT, but ASDM let's you select the DNS Rewrite for PAT.

To me it seems like it shouldn't work at all. How would the ASA know to return the IP for the web server instead of a different server using PAT to the same outside interface?

So I guess my question is, can I only use DNS Rewrites if I'm using NAT instead of PAT?

 

[jlazzaro]

http://www.cisco.com/en/US/pro...09186a00807968d1.shtml

NS rewrite is not compatible with static Port Address Translation (PAT) because multiple PAT rules are applicable for each A-record, and the PAT rule to use is ambiguous.

 

[Crusty]

BAH, how did I skip over that! I even read that same example

On a side note, does anyone else think ASDM is quite buggy?

 

[drebo]

Which version are you using?

The latest version (distributed with the 8.0 firmware on the CD with the ASA) is a piece of junk. The previous version, used with the 7.2 firmware, is pretty decent.

Obviously, command line is much more granular.

 

[Crusty]

7.2(4) firmware and 5.2(4) ASDM

I came into running this thing without knowing any Cisco CLI, and so long as I can do what I need with ASDM I'm going to put off learning the CLI until I have more time to really learn it

 

[drebo]

Interesting. If you think ASDM 5.2 is buggy, you should try PDM 3.0 or earlier...now there's an exercise in frustration.

In my (admittedly limited, compared to some) experience, Cisco's SDM which is used with the newer routers is the easiest, most bug-free config utility Cisco's offered to date.

 

[Crusty]

Originally posted by: drebo
Interesting. If you think ASDM 5.2 is buggy, you should try PDM 3.0 or earlier...now there's an exercise in frustration.

In my (admittedly limited, compared to some) experience, Cisco's SDM which is used with the newer routers is the easiest, most bug-free config utility Cisco's offered to date.

For the most part I've figured out the "proper" way to get things done in the gui, even if it's not the intended way

I've only run into one bug while configuring it where I had to restart ASDM, but that doesn't take very long!