PIX access to external IP

[neilntruong]

I have a PIX 506e. Everything works fine. Except when I'm inside the network, I cannot access my server if I try to access it from it's External IP. The server has a translation rule which binds it's external IP to it's internal IP.

If I am outside of the network I can access the server just fine through it's IP address. I only have problem when I try to access it's external I when I am on the same network as the server. If I try to acess the server from it's internal IP everything works fine.

 

[FloDiggs]

That is exactly how it is supposed to work. I think you may be asking the wrong question. What are you trying to get working? If it is a website, you would need to have your internal DNS server have a zone for the public domain name, and then the necessary records that point the the private ip addresses. Does that make sense?

 

[neilntruong]

We do have internal DNS. And it resolves our internal IP properly. Our problem is that we have a lot of employees using laptops. When they access our website outside of our network they resolve our website's external ip. The laptop caches that IP. When they comes in and link into our network and try to access the website it looks for it at the external IP address.

We've been doing an "ipconfig /flushdns" as a quick fix but we would like to find a permanent solution.

 

[neilntruong]

We can disable the DNScaching but dont want to slow down the employee's performance.

 

[FloDiggs]

Well, that is just how it is. You could create two favorites for those users. One with the internal server name for when they are in the office, and one with the public for when they are out of the office. Other than that, the users will need to flush their DNS, or shutdown their computers instead of using standby or hybernate when they are out of the office. You could also create a batchfile for each of them that has the ipconfig /flushdns in it. It would be a quick double click and they'd be up and running. I don't know what else to tell you.

 

[Supergrrover]

Try the DNS alias command - take a look at these

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094aee.shtml

http://www.cisco.com/en/US/products..._guide_chapter09186a008017278b.html#wp1063720

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[skb2005]

You can try the following. We had the same problem and was resolved. Use the word "dns" between local ip and the netmask.


static (inside,outside) 1.1.1.1 192.168.2.10 dns netmask 255.255.255.255 0 0

replace 1.1.1.1 with your public ip
192.168..2.10 with your local ip.

Hope this helps.