Cisco – DNS Doctoring / Reply Modification on Cisco 1900 series ISR

ciscocisco-ios-15dns

We have a Cisco 1900 ISR and have recently setup a web-server at ourdomain.com.
The site works perfectly, however from the LAN we cannot use ourdomain.com to access the site, instead everyone has to use the local IP address 10.1.1.xxx.

I've come to understand that its a limitation with Cisco routers. My extensive googling has turned up DNS doctoring (or DNS reply modification)

I've attempted many time to setup DNS doctoring but I just cant get it work, I believe because our ISR doesnt have the capability to peform the commands I'm trying:

object network our_server
host 10.1.1.xx
nat (inside,outside) static 50.100.100.10 dns

Is there another way to achieve DNS doctoring or otherwise access our local server using the external address?

Our network config is as follows: Modem > ISR > Switch > End Users

Our ISR is running: Cisco IOS Software, C1900 Software (C1900-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE SOFTWARE (fc1)

Best Answer

I've attempted many time to setup DNS doctoring but I just cant get it work, I believe because our ISR doesnt have the capability to peform the commands I'm trying

Your first problem is that you're using Cisco ASA commands on a Cisco router; you're also assuming this is a problem with your Cisco router.

In reality, this is a DNS issue that can be solved with your Cisco router; however, it's normally solved with a split-DNS

Is there another way to achieve DNS doctoring or otherwise access our local server using the external address?

Yes... Cisco calls it Network address translation (or nat)... Let's assume you have this topology...

                               +------------+
                        Fa0/0  | Cisco ISR  | Fa0/1
LAN w/ Webhost-----------------|            |-------------------
                        inside |            | outside (To ISP)
                   10.1.1.0/24 +------------+ 192.0.2.1
                                              192.0.2.2 (static translation for the webhost)

interface Fa0/0
 ip address 10.1.1.1 255.255.255.0
 no ip proxy-arp
 ip nat inside
interface Fa0/1
 ip address 192.0.2.1 255.255.255.0
 no ip proxy-arp
 ip nat outside
!
ip nat inside source list INSIDE_ADDRS interface FastEthernet0/1 overload
ip nat inside source static 10.1.1.50 192.0.2.2
!
ip access-list extended INSIDE_ADDRS
 permit ip 10.1.1.0 0.0.0.255 any
 deny   ip any any
!
ip route 0.0.0.0 0.0.0.0 192.0.2.254

Assume your internal Webhost address is 10.1.1.50 and you're using 192.0.2.2 (a second address given by your ISP) for your public A-record.. Thus, when you resolve "ourdomain.com" from google's resolver, you get...

[mpenning@Bucksnort ~]$ dig +short @8.8.8.8 ourdomain.com
10.1.1.50
[mpenning@Bucksnort ~]$

Assuming Bucksnort is 10.1.1.12, if you perform debug ip nat on your router during a DNS query, you see...

Sep 23 23:12:29.132 CDT: NAT: s=10.1.1.12->192.0.2.1, d=8.8.8.8 [0]
Sep 23 23:12:29.132 CDT: NAT: DNS resource record 192.0.2.2 -> 10.1.1.50
Sep 23 23:12:29.136 CDT: NAT: s=8.8.8.8, d=192.0.2.1->10.1.1.12 [628]
Sep 23 23:12:29.140 CDT: NAT: s=10.1.1.12->192.0.2.1, d=8.8.8.8 [0]
Sep 23 23:12:29.140 CDT: NAT: DNS resource record 192.0.2.2 -> 10.1.1.50
Sep 23 23:12:29.140 CDT: NAT: s=8.8.8.8, d=192.0.2.1->10.1.1.12 [629]
Sep 23 23:12:29.144 CDT: NAT: s=10.1.1.12->192.0.2.1, d=8.8.8.8 [0]
Sep 23 23:12:29.148 CDT: NAT: DNS resource record 192.0.2.2 -> 10.1.1.50
Sep 23 23:12:29.148 CDT: NAT: s=8.8.8.8, d=192.0.2.1->10.1.1.12 [630]
Related Topic