PIX DNS doctoring with 2003 server

A quick question guys.

I recently put a few firewalls in a customer premises with a static NAT policy. Internally the clients were 192.168.1.x but extrenally they were

135.1.1.x statically mapped one for one. DNS always worked ok since there were no servers on these sites - I accepted the limitaion that the machines cannot ping by machine name. This worked loads of times. I then had another site exactly like this but had a server as well as just client PC's. The clients could not get their drive mappings on this server until I clicked the DNS option against the static transation in the PDM. I understand and acknowledge this. BTW the DNS servers are on the central site

My problem. On the windows 2003 server - I noticed that rather than seeing the client PC's by their global address (135.x.x.x)- they were seeing the inside local address (192.168.1.x) on the browser!! How can this possibly be? The inside local addresses are not known at all outside the PIX's inside interface. Clicking on the doctor DNS tab for each individual host makes no difference. It's almost like there is some protocl between the server and PC where the real IP address on the clinet is revealed.

Any clues or ideas guys? Steve

Reply to
Rudyard Shackleton
Loading thread data ...

I'm afraid that your description of the situation isn't clear. If the server is in the same LAN with the clients then the above behaviour is expected. If they are in different LANs so that the server LAN and the clients LAN are connected via VPN tunnel then the above is also expected because usually you don't NAT traffic destinated to a VPN tunnel.

Reply to
Jyri Korhonen

Reply to
Rudyard Shackleton

Not necessarily. There are some protocol implementations which carry the IP address in the payload of an IP packet. We don't do Windows networking (we have Novell) so I don't know if Microsoft's solution is doing that. You might want to ask in some of the windows discussion groups.

Reply to
Jyri Korhonen

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.