Slow access to the server when it goes out and comeback through ASA 1

[rjanakan]

Hi,

I have an ASA 5510 installed in my environment. I have a application box which is behind the ASA needs to access the webserver which is also behind the ASA. The application box is configured to point to the URL rather than the local IP. For application configuration reasons we want to keep it in that way. It works faster when I used the local private IP. But when I give the URL, the application box times out. So looks like when the traffic goes out of ASA to Internet, it's getting resolved through DNS and when it hits ASA it's getting NAT-ed and processed again.

Is this common with ASA or any FW?
I'd appreciate any inputs on this.

 

[brianinms]

Well merely use internal dns to resolve the url to the private IP address.

 

[rubbaninja]

Or use a host file entry on the server

 

[rjanakan]

Hi,

Thanks for your input. Yes, I had it working using the hosts file to bypass the DNS. But I'd like to know the reason, if it's a common behavior with ASA or I'm missing some configuration.

Thanks,
Janakan Rajendran

 

[brianinms]

Its the ASA normal behavior, basically you were sending traffic out the firewall and trying to make it come back in. Thats not what the firewall is designed for.

 

[rubbaninja]

Did you add an access list on the dmz interface that allowed access from the DMZ server to your internal DNS servers on port 53?

 

[rjanakan]

Hi,

I just have 5 servers sitting behind ASA in my data center and pointing to ISP's DNS. So no DMZ and internal DNS.

Janakan Rajendran

 

[NetworkGhost]

Easy fix. I would guess you have some static statements in your firewall. Re-add the static statements with the keyword dns


So looks like this

static (inside,outside) 65.15.25.11 192.168.0.5 netmask 255.255.255.255 dns

What this will do is rewrite DNS replies traveling through the firewall that match 65.15.25.11 to 192.168.0.5.

Check this link out:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807968c8.shtml

with 7.0 the PIX/ASA can also send traffic back out the same interface with the intra-interface command:

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/vpnsysop.html#wp1042114

http://www.wr-mem.com

 

[brianinms]

Intra-interface only works on encrypted traffic, or at least its how the documents read.

 

[NetworkGhost]

The document is not accurate. Here is a better one:

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080734db7.shtml

http://www.wr-mem.com

 

[brianinms]

Thanks Man, I didn't have a clue it worked for clear text traffic as well. That documentation was a lot better than the the other as I was led to believe it was only for encrypted traffic.