Cisco ASA 5506-X Configuration Manual page 122

DNS and NAT
If the user needs to access ftp.cisco.com using the real address, then no further configuration is required.
If there is also a static rule between the inside and DMZ, then you also need to enable DNS reply
modification on this rule. The DNS reply will then be modified two times.In this case, the ASA again
translates the address inside the DNS reply to 192.168.1.10 according to the static rule between inside
and DMZ.
Figure 5-19
3
DNS Reply Modification 1
209.165.201.10
4
DNS Reply Modification 2
10.1.3.14
DNS Reply Modification, DNS Server on Host Network
The following figure shows an FTP server and DNS server on the outside. The ASA has a static
translation for the outside server. In this case, when an inside user requests the address for ftp.cisco.com
from the DNS server, the DNS server responds with the real address, 209.165.20.10. Because you want
inside users to use the mapped address for ftp.cisco.com (10.1.2.56) you need to configure DNS reply
modification for the static translation.
Cisco ASA Series Firewall CLI Configuration Guide
5-24
DNS Reply Modification, DNS Server, Host, and Server on Separate Networks
1
DNS Query
2
ftp.cisco.com?
DNS Reply
209.165.201.10
10.1.3.14
192.168.1.10
5
DNS Reply
192.168.1.10
Chapter 5
DNS Server
Static Translation 1
on Outside to:
209.165.201.10
Outside
Static Translation 2
on Inside to:
192.168.1.10
ASA
DMZ
Translation
Inside
192.168.1.10
FTP Request
192.168.1.10
User
NAT Examples and Reference
ftp.cisco.com
10.1.3.14
7
10.1.3.14
6