Local DNS Forwarding

Cisco Secure Access Virtual Appliances (VAs) are conditional DNS forwarders in your network, forwarding public DNS queries to Secure Access, and local DNS queries to your existing local DNS servers and forwarders, respectively.

When the VAs receive queries which match domains or subdomains of a local DNS zone (local domain), the VA forwards those queries to your local DNS server for resolution instead of the Secure Access public DNS resolvers. This is accomplished by defining your local domain names in Secure Access.

Do not set your local DNS forwarders to point to the VAs. It is possible to create loops in DNS in this configuration and it's not recommended or supported.

Any DNS queries received by the VAs which match a domain on the Internal Domains list, will be forwarded to the local DNS server as described in Configure Virtual Appliances.

The following domains/zones are pre-populated and do not need to be added:

• RFC1918 —non-publicly routable address spaces used only for reverse DNS on internal networks. All local IP address space for reverse lookups (PTR records) is covered with this entry. Adding in-addr.arpa reverse lookup zones are not needed.
• .local —Any domain name with a TLD of .local.

You have a choice of what type of identities are set to respect these internal domains:

• All Sites—Covers all requests that are made through a VA.
• Sites listed under All Sites—Covers requests only made through VAs deployed in the selected sites.
• All Devices—Covers all requests that are made through a roaming device.

Any domain name which has a forward lookup zone on your local DNS servers must be added, along with any domains that are configured with conditional forwarders. If you already know which domains to add, skip the Add A & PTR Records for the VAs section.

On Windows Server, this information is located in the DNS Manager tool.

1. Open the DNS Manager (Start > Run and type "dnsmgmt.msc").
2. Expand the Server name and Forward Lookup Zones sections.

   Any domains listed here are treated as local by your local DNS forwarders. Add these domains to your internal domains list in Secure Access. This is a critical part of the setup process.

3. If any public IPs are in use as local IPs, also add the Reverse Lookup Zone of any public IPs which have local DNS records attached. RFC-1918 reverse lookup zones are included by default. These are entered in the in-addr.arpa format.

   Note

   Be aware that it can take up to 10 minutes for the virtual appliance to synchronize with changes you make to the Internal Domains list.

Adding forward and reverse DNS records for your virtual appliances (VAs) helps identify them in your network topology, firewall logs, and security appliance logs.

Create the records appropriate for the VA’s deployment:

• IPv4-only: Create an A record and a corresponding IPv4 PTR record.

• IPv6-only: Create an AAAA record and a corresponding IPv6 PTR record.

• Dual-stack: Create A and AAAA records, with corresponding PTR records for both addresses. Create forward records in the domain’s DNS zone.

Create IPv4 PTR records in the applicable `in-addr.arpa` reverse lookup zone and IPv6 PTR records in the applicable ip6.arpa reverse lookup zone. Contact your DNS administrator if the required reverse lookup zone does not exist.

After creating the records, verify forward and reverse resolution as described below. Replace the example hostname and IP addresses with your VA’s configured values.

• Add a PTR record

• Add a host (A) record

After adding A and/or PTR records, verify the records:

nslookup <VA HOSTNAME>

nslookup va01.corp.domain.com
   
   Server: 192.168.1.1  
    Address: 192.168.1.1#53  
    Non-authoritative answer:  
    Name: va01.corp.domain.com  
    Address: 192.168.1.9

nslookup -type=AAAA va.example.com

nslookup <VA IP ADDRESS>

nslookup 192.168.1.10 
    
    Server:192.168.1.1  
    Address:192.168.1.1#53  
    Non-authoritative answer:  
    9.168.192.in-addr.arpaname = \[va01.corp.domain.com\]

You can configure the VA to send queries for local domains to any local DNS server. You can also selectively forward DNS queries for specific local domains to specific local DNS servers.

Use the following commands to configure the VA to send queries for local domains to local DNS servers:

config localdns add 2001:db8:300::53 corp.example.com 

Note

If you are assigning specific domains to specific local DNS servers, be sure to add at least one local DNS server with no domain assignment so that it can support queries for all other internal domains.

You can also combine the above features to have some local domains redirected to specific local DNS servers and other domains redirected to the remaining local DNS servers.