Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 3 replies
  • Subscribers 27 subscribers
  • Views 5161 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

External DNS Lookups Changing When Changing from Cisco ASA to XG

DavidPeterson

Okay, not thinking straight anymore.  After moving client to XG tonight form Cisco ASA external DNS is failing.  Their internal authoritative DNS server has private IPs for the host names, and with the ASA they'd respond to a DNS lookup as their NAT'd public IPs, and everything was happy.  I realized with the XG that the lookups now get the private IP, and mail can't come in.  DNSSTUFF test against the domain says no MX record.  Put the ASA back in line and the DNS tests pass and mail resumes.  Am I missing something stupid, or what was the ASA doing that I need to replicate?  Alternatively, is there a way to make the XG do what Sonicwall calls a loopback, where an internal host can access an internal resource by its public IP because the Sonicwall will bounce it back in to the private?  I used that a lot with Sonicwalls.



This thread was automatically locked due to age.
Parents
  • +1

    David,

    Accessing internal resources by public ip is possible. Create a business rule application and you will be able to access internal resources by public ip.

    For the dns aspect, XG can act as dns server so it replies to know A records directly. You can configure XG to forward dns requests to other dns servers under network > dns > dns request route.

    Regards

  • 0 in reply to lferrara

    Sorry for the late follow-up, but had to work on other aspects of the firewall and network.  I assume by business rule you mean setting the rule where the source and destination zones are both the LAN, with appropriate other entries.

    Also, it doesn't appear it that it would resolve DNS queries through (not to) the XG in some kind of transparent mode, which I'd think would be undesirable behavior anyway, certainly by default.  Is what you are saying is that it would have to be a nameserver for the domain?  I'd most likely use the business rule method, but just curious.

Reply
  • 0 in reply to lferrara

    Sorry for the late follow-up, but had to work on other aspects of the firewall and network.  I assume by business rule you mean setting the rule where the source and destination zones are both the LAN, with appropriate other entries.

    Also, it doesn't appear it that it would resolve DNS queries through (not to) the XG in some kind of transparent mode, which I'd think would be undesirable behavior anyway, certainly by default.  Is what you are saying is that it would have to be a nameserver for the domain?  I'd most likely use the business rule method, but just curious.

Children
No Data