Be sure you have the permit statement for DNS(53) applied to the outside interface via access-list. Unless you put the DNS server in a DMZ, you shouldn't really need access-lists applied to the inside interface IMO.
Whether or not you have a web server that is also running on the same machine as DNS, or a mail server, you will need to make sure you put a public address A record for said server in your DNS zone along with however you choose to resolve the WWW/SMTP/POP3 Server on the inside.... or implement the alias command on the PIX to have the PIX auto-magically modify inside DNS requests to the public-addressed host so that you resolve to its private address. Caveat to the alias command though is that with it in place, you can only use the PIX PDM in Monitor mode- PDM doesn't support Alias statements... You'd think Cisco would change that in the next update to the PDM. HINT HINT Cisco!!?!? :) Hope that helps. Mark -----Original Message----- From: Curious [mailto:[EMAIL PROTECTED]] Sent: Tuesday, September 10, 2002 2:06 PM To: [EMAIL PROTECTED] Subject: DNS Behind the firewall [7:53016] My Company's DNS server resides on our External LAN (our Public LAN), yesterday we move it to our Private LAN (Behind our PIX 515), and Nated its Public IP address with its new Private IP Address in the Firewall and Open Port 53. After all that move and settings we were able to resolve domain names from Private LAN but not from Public Lan or Internet. Please let me know if some one has any idea Y.......? Curious MCSE, CCNP Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=53023&t=53016 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
