Cisco ASA Series Cli Configuration Manual page 774

DNS and NAT
! Use twice NAT to pass traffic between the inside network and the VPN client without
! address translation (identity NAT), w/route-lookup:
nat (outside,inside) source static vpn_local vpn_local destination static inside_nw
inside_nw route-lookup
Troubleshooting NAT and VPN
See the following monitoring tools for troubleshooting NAT issues with VPN:
•
•
•
To familiarize yourself with a non-working configuration vs. a working configuration, you can perform
the following steps:
1.
2.
3.
•
DNS and NAT
You might need to configure the ASA to modify DNS replies by replacing the address in the reply with
an address that matches the NAT configuration. You can configure DNS modification when you
configure each translation rule.
This feature rewrites the address in DNS queries and replies that match a NAT rule (for example, the A
record for IPv4, the AAAA record for IPv6, or the PTR record for reverse DNS queries). For DNS replies
traversing from a mapped interface to any other interface, the record is rewritten from the mapped value
to the real value. Inversely, for DNS replies traversing from any interface to a mapped interface, the
record is rewritten from the real value to the mapped value.
Note
If you configure a twice NAT rule, you cannot configure DNS modification if you specify the source
address as well as the destination address. These kinds of rules can potentially have a different
translation for a single address when going to A vs. B. Therefore, the ASA cannot accurately match the
IP address inside the DNS reply to the correct twice NAT rule; the DNS reply does not contain
information about which source/destination address combination was in the packet that prompted the
DNS request.
Figure 1-22
on the inside interface. You configure the ASA to statically translate the ftp.cisco.com real address
(10.1.3.14) to a mapped address (209.165.201.10) that is visible on the outside network. In this case, you
want to enable DNS reply modification on this static rule so that inside users who have access to
ftp.cisco.com using the real address receive the real address from the DNS server, and not the mapped
address. When an inside host sends a DNS request for the address of ftp.cisco.com, the DNS server
replies with the mapped address (209.165.201.10). The ASA refers to the static rule for the inside server
Cisco ASA Series CLI Configuration Guide
1-28
Packet tracer—When used correctly, a packet tracer shows which NAT rules a packet is hitting.
show nat detail—Shows hit counts and untranslated traffic for a given NAT rule.
show conn all—Lets you see active connections including to and from the box traffic.
Configure VPN without identity NAT.
Enter show nat detail and show conn all.
Add the identity NAT configuration.
Repeat show nat detail and show conn all.
shows a DNS server that is accessible from the outside interface. A server, ftp.cisco.com, is
Chapter 1 Information About NAT