DNS Conditional Forwarder and NAT

U

USF-Nealio

Limp Gawd
Joined
Jan 18, 2012
Messages
373
The head Network Admin is out for a while, and I've been tasked with filling his shoes for the time being. Primarily keeping the network functional, not necessarily doing all of work. There's just 1 thing that HAS to get done, and I'm struggling.

We recently established a site to site VPN with a new client. The VPN tunnel is up, and everything is rocking steady. The one catch is that my site was already connected to another site with the 192.168.1.X/24 address range, so naturally, a NAT was setup so that everything at the customer site appears as 192.168.20.X/24. I can ping and access all of their devices by IP, but am unable to resolve local DNS address for the devices on their network. I've tried building a Conditional Forward in our DNS server, but when I try to nslookup or ping, it returns the non-NATed address. I've been looking for answers around the net, but I've come up with nothing. What should I look at?
 
You know, I have never had to deal with that before. Beyond creating a 'fake' zone that mimics the customer's zone, only with the NAT'd addresses, I'm not sure how I would handle that ( and depending on the type of traffic, that may very well NOT work ).

Do you have any other clients that you can look at the setup on? Is this the first time your company has come across this issue?
 
This is the first time we've run across this. We have have NATs with plenty of companies, but we've never needed to resolve local DNS before.
 
USF-Nealio said:
This is the first time we've run across this. We have have NATs with plenty of companies, but we've never needed to resolve local DNS before.
Click to expand...
Unfortunately I don't know of any software package out there that will "translate" DNS responses.

That's not to say it's not possible. I can envision a solution with a bind server + bash to "recreate" the zone files and host a master copy locally for your staff to resolve those addresses. I would treat this as a "last resort" solution, but it's possible if push come to shove.
 
I'm primarily trying to avoid creating static DNS entries for all of the servers we need to access.
 
Tbh, you will need a seperate DNS zone specifically for the site, NAT should be avoided at all costs over VPN but in this instance you can't.

Just remember i believe Windows trusts are not supported over NAT if that is where you are headed.
 
You need to take the conditional forward out of the DNS server and create static dns entries for the devices you need to access with the nat'd addresses. You could also just add them to your local hosts file as a quick fix, depending on how many machines will need to access these devices.
 
Is there perhaps something I can do in the VPN configuration to accomplish this? It's a Cisco to Cisco IPsec Lan-to-Lan.
 
mvulcan said:
You need to take the conditional forward out of the DNS server and create static dns entries for the devices you need to access with the nat'd addresses. You could also just add them to your local hosts file as a quick fix, depending on how many machines will need to access these devices.
Click to expand...

Across a company of 150 users. I can create static DNS entries, but I'm trying to avoid the administrative burden of updating the changes.
 
USF-Nealio said:
Across a company of 150 users. I can create static DNS entries, but I'm trying to avoid the administrative burden of updating the changes.
Click to expand...
A friend of mine reminded me that ASAs do this...I think they do this. I could very well be wrong, so someone with some cisco experience I hope will come in here and say so if I am.

But I seem to recall some functionality in my ASA ( way back when ) that would automatically do NAT/DNS conversions for me.
 
Unfortunately, I don't have any ASA's. We have 38XX routers and VPN 3000 Concentrators. I'm not entirely sure what's at the other side of the tunnel.
 
You must log in or register to reply here.
Back
Top