PIX firewall and outgoing web requests to an internal server

We have a PIX firewall in front of an ISA server. The PIX firewall
faces the Internet, and the ISA server handles the web publishing
rules. A client on the outside can get to our site using our public
domain name (www.company.com), but if a client on the inside uses the
public domain name the connection times out. A static command NATs
traffic from the external interface to the ISA server, and all traffic
leaving the network is nat-ed to the address of the enternal
interface. I think this is the cause of the problem since to the PIX
the foreign address and global address are the same. If anyone has any
insight I'd appreciate it.

Thanks,
Sean

 

:We have a PIX firewall in front of an ISA server. The PIX firewall
:faces the Internet, and the ISA server handles the web publishing
:rules. A client on the outside can get to our site using our public
:domain name (www.company.com), but if a client on the inside uses the
ublic domain name the connection times out. A static command NATs
:traffic from the external interface to the ISA server, and all traffic
:leaving the network is nat-ed to the address of the enternal
:interface. I think this is the cause of the problem since to the PIX
:the foreign address and global address are the same. If anyone has any
:insight I'd appreciate it.

No, that's not the cause of the problem. The cause of the problem
is that the PIX never ever routes packets back out the same interface
they came in on. Your internal requests to www.company.com are being
translated to the external IP address, and and your internal hosts
know that's not a local IP address so they send the packet to their
gateway (which is probably the PIX.) Even if the PIX knew how to get
the packet back to the server (which it doesn't really), it will refuse
to do so, since that would involve sending it back to the same interface.

To solve this problem, you must have your internal people use
the internal IP address, or you must have your people use a -different-
hostname that resolves to the internal IP address, or you must arrange
so that to *your* people, the hostname resolves to the internal IP address.
The mechanism to arrange so that *your* people are told the internal
IP address but the public gets told the external IP adress, depends upon
exactly where your DNS server is. If your DNS server is external
and you are using anything before 6.3(3), use the 'alias' command.
If your DNS server is external and you are using 6.3(3) then
there is an extension to the 'static' command that you should use instead.
If your DNS server is internal, then reconfigure your DNS server to
use "split views" [the BIND9 DNS server can handle that.]

 

For installations we have done with this topology, the alias statement
works:

If you have a DNS server on outside and web server is inside with client,
and client wants to go to web server using dns, then use:

alias (inside) local global

replaces the DNS query global addr with the local addr for inside hosts only

If the host is in a DMZ, reverse the local global addresses (in the alias
statement).