DNS Reply Modification, DNS Server on Host Network

The following figure shows an FTP server and DNS server on the outside. The system has a static translation for the outside server. In this case, when an inside user requests the address for ftp.cisco.com from the DNS server, the DNS server responds with the real address, 209.165.20.10. Because you want inside users to use the mapped address for ftp.cisco.com (10.1.2.56) you need to configure DNS reply modification for the static translation.

Before you begin

Ensure that you have interface objects (security zones or interface groups) that contain the interfaces for the device. In this example, we will assume the interface objects are security zones named inside and outside. To configure interface objects, select Objects > Object Management, then select Interface.

Procedure

Step 1

Create the network objects for the FTP server.

Choose Objects > Object Management.
Select Network from the table of contents and click Add Network > Add Object.
Define the real FTP server address.

Name the network object (for example, ftp_server) and enter the host address, 209.165.201.10.
Click Save.
Click Add Network > Add Object and define the FTP server's translated address.

Name the network object (for example, ftp_server_translated) and enter the host address, 10.1.2.56.
Click Save.

Step 2

Configure the static NAT rule with DNS modification for the FTP server.

Select Devices > NAT and create or edit the threat defense NAT policy.
Click Add Rule.
Configure the following properties:
- NAT Rule = Auto NAT Rule.
- Type = Static.
On Interface Objects, configure the following:
- Source Interface Objects = outside.
- Destination Interface Objects = inside.
On Translation, configure the following:
- Original Source = ftp_server network object.
- Translated Source > Address = ftp_server_translated network object.
On Advanced, select Translate DNS replies that match this rule.
Click OK.