Ok ATNO/TW,
Correct me if I am wrong on the Scenario.
Scenario2 domain names that do not have an associated DNS Server (Godaddy only has the name, you need to point it to an authorized DNS Server that has the addresses and the IP's on it)
1 domain name that is on the ISP DNS server that points to your static IP.
1 IIS/DNS Server on LAN
1 Cisco Pix on LAN/WAN that has 1 external address assigned to it.
ResolutionDNSFirst and formost, you cannot, cannot, have the lan domain be the same domain as one of the websites. Are you running Active Directory or are the machines in a Workgroup?
Second, the tricky aspect of local LAN clients using that DNS server.
If you go to http://www.domain1.com, your DNS will be set to return 216.external.number.44 to make external people get the right address, and your local client will never resolve the address because of NAT. It would need the local 172.16.1.20 address instead of the external for communication to the server on the LAN.
I propose not using this DNS for local at all, and making another DNS server for local.
So on your existing DNS server that will be used for EXTERNAL connections, open DNS and go New forward lookup zone.
domain1.com
domain2.com
domain3.com
In each, you put www. and BLANK A records to point to the external address of the PIX. *under assumption you have 1 ip address*
PIXAs of PIX 6.2 use static route. Insert actual values wherever you see my <example> without the < >.
static (inside, outside) tcp interface 53 <dnsserverip> 53 netmask 255.255.255.255 0 0
static (inside, outside) udp interface 53 <dnsserverip> 53 netmask 255.255.255.255 0 0
static (inside, outside) tcp interface 25 <mailserverip> 25 netmask 255.255.255.255 0 0
static (inside, outside) tcp interface 80 <webserverip> 80 netmask 255.255.255.255 0 0
static (inside, outside) tcp interface 443 <webserverip> 443 netmask 255.255.255.255 0 0
conduit permit tcp any eq 53 <dnsserverip>
conduit permit udp any eq 53 <dnsserverip>
conduit permit tcp any eq 25 <mailserverip>
conduit permit tcp any eq 80 <webserverip>
conduit permit tcp any eq 443 <webserverip>
- static (inside, outside) tcp interface 53 <dnsserverip> 53 netmask 255.255.255.255 0 0
- static (inside, outside) udp interface 53 <dnsserverip> 53 netmask 255.255.255.255 0 0
-
- static (inside, outside) tcp interface 25 <mailserverip> 25 netmask 255.255.255.255 0 0
-
- static (inside, outside) tcp interface 80 <webserverip> 80 netmask 255.255.255.255 0 0
- static (inside, outside) tcp interface 443 <webserverip> 443 netmask 255.255.255.255 0 0
-
- conduit permit tcp any eq 53 <dnsserverip>
- conduit permit udp any eq 53 <dnsserverip>
-
- conduit permit tcp any eq 25 <mailserverip>
-
- conduit permit tcp any eq 80 <webserverip>
- conduit permit tcp any eq 443 <webserverip>
-
For you, the dns mail and webserver ip are the same in the scenario.
Using ASDM then you create firewall rules to allow any to the two servers for those ports.
IISNow for IIS you need to create the 3 sites, all as 80/443, but different directories with different HOST HEADER VALUES.
You can test this internally easily, by using the INTERNAL DNS server you made, and having the 3 forward lookup zones point to the same webserver.
GoDaddyPoint all domains to use the DNS server of OUTSIDE PIX Address