DNS translation feature configuration example - 飞塔技术

姓名：大萝卜职业：听人说，技术支持是IT业最鸡肋的职业，于是我便开始郁闷起来! 个性签名: 我以为我们同属于/30，Ping出Timed out才明白处于不同的Vlan。我尝试着用爱做为Route，并用Traceroute来验证，可是Netstat的Syn_received结果让我无比伤心。于是我选择了deny any和deny ip any any,但是我心里一直期待着Vpn那天的到来,请将我放在你的Acl之内。 Mailto:bxz1981#gmail.com

DNS translation translates IP addresses in packets sent by a DNS server from the internal network to the external network. Use DNS translation if you have a DNS server on your internal network that users can access on the external network to find the IP addresses of servers on your internal network.

Note: This is usually a DNS server feature.

Configuring the DNS translation
on your FortiGate unit

Configure the DNS helper using the CLI. Enter the following commands:
config sys session-helper
    edit 15
          set name dns_udp
          set port 53
          set protocol 17
          next
    edit 16
          set name dns_tcp
          set port 53
          set protocol 6
          next
    end
Configure one virtual IP for the DNS.
Configure one virtual IP for each internal server.
Configure a DNS translation rule for each internal server:

config firewall dnstranslation
  edit 1
  set dst'external address of the FortiGate'
  set netmask 255.255.255.255
  set src 'internal address of the server'
  next
end

Configuration Example

Step 1: Session-Helper

config sys session-helper
    edit 15
        set name dns_udp
        set port 53
        set protocol 17
        next
    edit 16
        set name dns_tcp
        set port 53
        set protocol 6
        next
    end

Step 2: VIP for the DNS server

external IP 172.31.224.203
port 53
internal IP 10.100.0.3
port 53

Session 3: VIP for the internal web server

external IP 172.31.224.203 port 80 internal IP 10.100.0.23 port 80


Step 4: DNS translation rule for internal web server
config firewall dsntranslation
    edit 1 
        set dst 172.31.224.203
        set netmask 255.255.255.255
        set src 10.100.0.23
        next 
    end

请问，这个能否解决“内网服务器NAT后，内部工作站无法通过外部IP访问内部服务”的问题？

比如，内网web server 10.100.0.3，通过Router或Fortigate映射到 172.31.224.203:80，域名 mydomain.com 。此时内网PC 10.100.0.50 如何访问 mydomain.com??

华为router 请通过nat dns 命令来做，具体使用请参照本BLOG中华为技术里有一篇文章。
cisco pix 可以通过alias命令来做。
cisco router 新版本中好象没有此种问题，不太确定。
fortigate 有这样的问题？~

是滴，偶就碰到了：）外面可以访问 mydomain.com；内网不可访问。

原来webserver (IP号23)是通过第二个路由器出去，PC通过Fortigate出去，就没有问题。现在，在Fortigate上做了双线冗余，使用策略路由来划分出站流量。结果，内部PC（IP 50）就无法访问 mydomain.com。 Ping的时候,<1ms。但是无法返回。

按道理来说，应该没有这种问题的，按你现在的结构，进出口的数据包是通过不同的路通过防火墙，因为FG防火墙为状态检测防火墙，故数据包为drop了，而为什么又能ping通呢？ICMP协议不像TCP一样，有状态可言。
试试以下操作：
fg#config sys gl
set asymroute enable
end
看看，我以前遇到这种情况，起用异步路由这条命令后，就正常了。good luck for you!!!

异步路由执行出错, 手册上说法, 可能需要设置 troubleshoot 状态.
Fortigate-100A # config system global
(global)# set asymroute enable
command parse error before 'asymroute'
Command fail. Return code -61
(global)#

是的，是双WAN。其中, web server通过WAN2 端口映射, PC 则通过 WAN1 端口映射。而且，无论是 Web server 本身(WAN2 IP23) 还是 PC (WAN1 IP50) 均无法成功访问 mydomain.com 。怪了去了~~

fortios 多少? 手册上是怎么说的,可否说全一点.
#config-version=FGT1KA-3.00-FW-build318-060630:opmode=0:vdom=0:user=admin
#conf_file_ver=2706503685636196210
config system global
    set CC-mode disable
    set admin-port 80
    set admin-sport 443
    set admin-ssh-port 22
    set admin-telnet-port 23
    set admintimeout 15
    set allow-interface-subnet-overlap disable
    set asymroute enable
    set auth-http-port 1000
    set auth-https-port 1003
    set auth-keepalive disable
    set authtimeout 15

forti3.0 mr2 build318 还有这个命令,好象到mr3就没有了,我刚刚也看了,等等,
这应该是异步路由有问题,我查查MR3文档,是不是异步路由的命令改掉了.

在fortios 3.0 mr3 上,
Fortigate-100 # config sys settings

(settings)# sh

(settings)# set
*opmode                     firewall operation mode
asymroute                  asymmetric route
sip-helper                 helper to add dynamic sip firewall allow rule
multicast-forward          multicast forwarding
multicast-ttl-notchange    multicast ttl not change

(settings)# set asymroute en

(settings)# end

Fortigate-100 #

以前的版本,
采用config sys gl
set asymroute en
end
即可.

good luck for U !

Configuring the DNS translationon your FortiGate unit

Configuration Example

Step 1: Session-Helper

Step 2: VIP for the DNS server

Session 3: VIP for the internal web server

Step 4: DNS translation rule for internal web server

Configuring the DNS translation
on your FortiGate unit