Cisco Catalyst 6500 Series - Page 158

9-14
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide
OL-6392-01
Chapter 9 Configuring Network Address Translation
NAT Overview
When an inside host sends a DNS request for the address of ftp.cisco.com, the DNS server replies with
the global address (209.165.201.10). The FWSM refers to the static statement for the inside server and
translates the address inside the DNS reply to 10.1.3.14. If you do not enable DNS reply modification,
then the inside host attempts to send traffic to 209.165.201.10 instead of accessing ftp.cisco.com
directly.
Figure 9-6 DNS Reply Modification
See the following command for this example:
FWSM/contexta(config)# static (inside,outside) 209.165.201.10 10.1.3.14 netmask
255.255.255.255 dns
DNS Server
FWSM
Outside
Inside
User
104642
1
2
3
4
5
6
ftp.cisco.com
10.1.3.14
DNS Reply Modification
209.165.201.10 10.1.3.14
DNS Reply
209.165.201.10
DNS Reply
10.1.3.14
Static Translation
209.165.201.1010.1.3.14
DNS Query
ftp.cisco.com?
FTP Request
10.1.3.14