Cisco ASA using Multiple DNS Names

Hi,
I am trying to setup a Cisco ASA for SSL vpn; however due to load balancing/traffic redirection performed by a different device; I was wondering if it may be possible perform a certificaate signing request/certificate required for it to have multiple address? An example would be:
IP: 1.1.1.1, fqdn: vpn1.asa.com
IP: 1.1.1.2, fqdn: vpn2.asa.com
IP: 1.1.1.3 fqdn: vpn3.asa.com
Not too sure on how to perform the CSR for it on the ASA? Do I create the csr cert with a single cn=vpn1.asa.com and ask the CA vendor to sign it off with SANsof vpn2.asa.com and vpn3.asa.com?
Client performing ssl vpn on vpn1.asa.com or vpn2.asa.com or vpn3.asa.com should not be prompted certificate warning.
Thanks.

Hi,
Appreciate the input. For the setup; the different fqdn is used due to different authentications/locations/etc... used. I have further illustrate the setup using the same interface for vpn access:
vpn3.asa.com (Extranet Vendor Access)--------------------------------|
                                                                                           |
                                                                                          |
                                                                                          |
vpn1.asa.com (External branch offices)-------------------------------ASA -------------Internal authentication servers
                                                                                           |
                                                                                           |
vpn2.asa.com(HQ/Corporate Users)-----------------------------------------
Not too sure for the creation of the CSR with a single cn=vpn1.asa.com and ask the CA vendor to sign it off with SANs of vpn2.asa.com and vpn3.asa.com as well as vpn1.asa.com?
Thanks.

Similar Messages

Using Multiple Domain Names to Access Our Portal

We operate one domain corp.company.com but all internal intranet web servers get assigned the address inside.ZZZ. The inside.ZZZ is on our IE exclusion list but company.com is not. Adding company.com seems to be a miserable task so we are looking at adding an alias so our users can access the server at the new inside.ZZZ url. We have DNS pointing the URL to the right server and that seems to be working properly.
Something within the application is redirecting the page to gnwhepdev.corp. company .com (our servers domain address) after the initial login. Since *.corp. company .com is not in the exclusion list, it is considered an outside address and rerouted. We are trying to find some way to pass the alias within the application itself so that we dont need *.corp. company .com in the exclusion list and we can point users to the inside.ZZZ url.
Our team researched this issue and found documentation that supported the use of multiple domain names to access a Enterprise Portal. The documentation that we found is below:
How ToConfigure the J2EE Engine Deployment Descriptor (Version 1.00 July 2004)
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/d0eb8120-b66c-2910-5795-894f384fc054
Particularly on page 13-15 in the documentation it talks about enabling the portal via multiple domain names (Section 3.7: Using Multiple Domain Names to Access the Portal). Also, the documentation says the following:
You must have sever proxy servers, each with a different domain name. You then activate the filter mechanism and configure it to work with several proxy servers
We have several questions about the possiblities of being able to set this up and whether it would require another server where Web Dispatcher would need to be installed for this configuration to work properly. Can someone please provide some insight into what needs to be configured and answer the question about the Web Dispatcher? Also, if Web Dispatcher is required, what steps need to be done to configure? If Web Dispatcher is not needed, what will we need to do apart from that to set this up for our Enterprise Portal system?

It is but you have to use masking......
http://iwebfaq.org/site/iWeb_Domains.html

Getting single "generic" WLS 4.5.1 app to serve multiple DNS names, including SSL

Hi everybody,
I am trying to figure out a strategy to enable a single web application
based on WLS 4.5.1 (SP13) running on Linux to serve multiple DNS
names, with some specific pages to be transmitted using SSL.
While the JSP pages differ in colouring and screen layout (but not in
logic),
the entire EJB business logic is identical for all DNS names. So are the
servlets.
The application data to be presented to the user can easily be mapped,
and presently (with the application responding to a single DNS name)
it is cached using a JNDI tree. To minimize coding effort, and
to continue utilizing the present caching concept, only expanding it to
support
multiple similar "virtual" applications, I would prefer to
continue using a single WLS instance when making the application "generic".
But as a consequence of this, I could only present a single SSL certificate
to the user if I had WLS answer internet HTTP requests directly.
What would you think should be done to get the browsers
"display the closed padlock while in the order form" for multiple DNS names
served by this same application instance?
One approach might be to put Apache in front of WLS, and configure it
to serve multiple virtual hosts (one for each DNS name to be served,
encoding the differences between the request URLs somehow in the ServerPath
directive, and providing a separate SSL certificate for each of those
virtual
hosts).
Does this make sense to you? Any experience in this area? Which Apache
and WL modules should I be using - which combination
of mod_proxy, mod_ssl (by Apache), mod_wl, mod_wl_ssl[_raven] ?
Any input would be greatly appreciated! Thanks in advance!
Ruben
[A minor add-on question is: Is the situation truly different with
WLS 6.0? I understand it supports virtual hosting on its own. Can multiple
(web) applications running under a single common WLS "umbrella" server
instance share the same application data? I would expect so - is this true?]

Ruben, I can't help you with the specifics of the configuration but your
general strategy seems correct to me. WLS does not handle multiple certs
and one must front it with a Web server if multiple certs are required.
Neil Smithline
WLS Security Team
BEA Systems
"Ruben-B Reincke" <[email protected]> wrote in message
news:[email protected]...
Hi everybody,
I am trying to figure out a strategy to enable a single web application
based on WLS 4.5.1 (SP13) running on Linux to serve multiple DNS
names, with some specific pages to be transmitted using SSL.
While the JSP pages differ in colouring and screen layout (but not in
logic),
the entire EJB business logic is identical for all DNS names. So are the
servlets.
The application data to be presented to the user can easily be mapped,
and presently (with the application responding to a single DNS name)
it is cached using a JNDI tree. To minimize coding effort, and
to continue utilizing the present caching concept, only expanding it to
support
multiple similar "virtual" applications, I would prefer to
continue using a single WLS instance when making the application"generic".
>
But as a consequence of this, I could only present a single SSLcertificate
to the user if I had WLS answer internet HTTP requests directly.
What would you think should be done to get the browsers
"display the closed padlock while in the order form" for multiple DNSnames
served by this same application instance?
One approach might be to put Apache in front of WLS, and configure it
to serve multiple virtual hosts (one for each DNS name to be served,
encoding the differences between the request URLs somehow in theServerPath
directive, and providing a separate SSL certificate for each of those
virtual
hosts).
Does this make sense to you? Any experience in this area? Which Apache
and WL modules should I be using - which combination
of mod_proxy, mod_ssl (by Apache), mod_wl, mod_wl_ssl[_raven] ?
Any input would be greatly appreciated! Thanks in advance!
Ruben
[A minor add-on question is: Is the situation truly different with
WLS 6.0? I understand it supports virtual hosting on its own. Can multiple
(web) applications running under a single common WLS "umbrella" server
instance share the same application data? I would expect so - is this
true?

How do you setup a server to use multiple DNS servers that are not connect to each other?

Is there a way to setup a server that connects to two different domains to use the proper DNS server for name resolution?
Let say there are two DCs: serverA.subdomaina.domain.com and serverB.subdoamainb.domain.com. The domains are independent and not connected. Now you need a common server that is connected to both and need to resolve names from both
domains.
Is this possible?
I have setup a server in a workgroup. One NIC has the subdomaina.domain.com connection specific suffix and the other nic has the subdomainb.domain.com. Each NIC has the DNS server listed for the domain it is connected to.
This configuration will resolve FQDNs of one domain but not the other. This I believe is due to the fact the server only querys one DNS server and doesn't try the other DNS server.
Is there any way to make the server try another DNS server, if the first one doesn't have the entry?

Hi,
Thank you for posting in Windows Server Forum.
Here adding to the words of “Tim”, a forwarder is a DNS server on a network used to forward DNS queries for external DNS names to DNS servers outside of that network. You can also forward queries according to specific domain names using conditional forwarders.
A DNS server on a network is designated as a forwarder by having the other DNS servers in the network forward the queries they cannot resolve locally to that DNS server. You can refer information regarding forwarders and how to configure from beneath link.
Understanding forwarders
http://technet.microsoft.com/en-us/library/cc782142(v=ws.10).aspx
Configure a DNS Server to Use Forwarders
http://technet.microsoft.com/en-us/library/cc754941.aspx
Hope it helps!
Regards.

Kerberos error when using a DNS name that doesn't match the Active Directory domain name

I am running into a weird issue with a new SQL Reporting Services server I built. I installed SQL Reporting 2014 on Windows Server 2012 R2 and configured Kerberos, but the site is extremely slow. After some reconfiguration and log captures I have determined
the issue has to do with the Kerberos setup but it is an exact replica of a Windows Server 2008 R2 server we currently have and it does not have these issues.
The error I see while using Wireshark is KRB Error: KRB5KDC_ERR_BADOPTION NT Status: STATUS_NO_MATCH.
When I drill down the into the error I can see the kerberos string is testprjmnmtreports14.company.com, which is the URL we are using to access the site. I made sure to add that name as an SPN for the service account that is running SQL Reporting Services,
however I still receive the error.
Then I tried configuring the site to run without a hostheader, so I accessed the site with the server name ECTSTSQLRS5 and the site works perfectly fine, no errors are reported either. So it seems I have isolated the issue down to Kerberos but I am not sure
how to resolve it. Here is some more information about my environment:
DNS/URL used: testprjmnmtreports14.company.com
Server Name (FQDN): ECTSTSQLRS5.company.int
AD Domain Name: company.int
Server Version: Windows Server 2012 R2
AD Functional Level: 2008 R2
I also have the following SPNs set for my SQL service account:
http/testprjmngmtreports14.company.com
http/testprjmngmtreports14
http/ECTSTSQLRS5.COMPANY.INT
http/ECTSTSQLRS5
As you can see I am trying to use a .com address but my AD domain is .int which I think is the issue, but I do not have the same problem on my other server that is running Windows Server 2008 R2.
Has anyone see this issue before? What do I need to do to allow my new site on 2012 R2 to work with this DNS Alias?
Thanks,
Brandon

Hi
Quote from there; Kerberos errors in network captures
The most common scenario is a request for a delegated ticket (unconstrained or constrained delegation). You will typically see this on the middle-tier server trying to access a back-end server. There are several reasons for rejection:
1. The service account is not trusted for delegation
2. The service account is not trusted for delegation to the SPN requested
3. The user’s account is marked as sensitive
4. The request was for a constrained delegation ticket to itself (constrained delegation is designed to allow a middle tier service to request a ticket to a back end service on behalf on another user,
not on behalf of itself).
Regards, Philippe
Don't forget to mark as answer or vote as helpful to help identify good information. ( linkedin endorsement never hurt too :o) )
Answer an interesting question ? Create a
wiki article about it!

Cut-Through Proxy / Authentication Proxy on Cisco ASA using ISE as AAA Server for allocating SGTs

Hi,
We are trying to setup ASA to do cut-through authentication proxy, and use ISE as RADIUS. We can successfully authenticate the user from Radius on the ASA, while he opens a web-page, but then it displays the error: authorization denied.
What we want:
ISE to allocate a security group tag to the user session when he logs in, that tag would carried within out cisco network infrastrucutre to define the access
policy for that user.
Can someone please help me with a sort of step by step thing for ISE configuration to allocate SGTs/SGACL for the user session after authentication is completed.
Thanks
Lovleen

Please refer to below step by step config guide for security group access policies
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_sga_pol.html

Popup for credentials when connecting to OWA/ECP when using HLB DNS name

Hi,
We're experiencing a strange problem when connecting to OWA/ECP.
Since a week or two, we get a popup for credentials when logging onto
https://mail.customer.com/owa.
When the credentials are filled in the first time, we keep receiving the popup, and can't get through.
We're using integrated authentication internally.
When connecting externally, we get a popup from a non domain-joined pc, but get passed correctly to owa and ECP.
We're using a load balancer that uses mail.customer.com, and distributes it over the 3 exchange servers.
When connecting directly to each exchange server, we get a certificate warning (which is logic), but after confirming we get passed to ecp or owa correctly.
Works :
https://exchangeserver1.customer.com/owa (after receiving certificate warning)
https://exchangeserver2.customer.com/owa (after receiving certificate warning)
https://exchangeserver3.customer.com/owa (after receiving certificate warning)
https://10.10.10.30/owa (after receiving certificate warning) > 10.10.10.30 is the VIP ip address used for loadbalancing
Doesn't work :
https://mail.customer.com/owa
When changing the hosts file, and set mail.customer.com to point directly to one of the exchange servers, it doesn't work either.
PS :
So mail.customer.com gets forwarded to the VIP ip address.
We don't experience any problems with outlook.

Hi
Chek if VIP FQDN is added to DNS
Check if RpcClientAccessServer parameter using Set-MailboxDatabase for each mailbox database in the appropriate site
Set-MailboxDatabase -RPCClientAccessServer "CASArrayFQDN"
Change AutoDiscoverServiceInternalUrl on each CAS using Set-ClientAccessServer
Change InternalUrl parameter on each CAS using Set-WebServicesVirtualDirectory Identity EWS*in the appropriate site
Change the InternalURI in the Exchange Control Panel, offline address book, and Microsoft Exchange ActiveSync (through management console under server management for each appropriate CAS)
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question.That will encourage me - and others - to take time out to help you.
Regards,
Sathish

Cisco ASA SNMP OIDs (show name, show vpn-sessiondb l2l)

Hi all,
I am trying to figure out the SNMP OIDs that is equivalent to the following ASA commands:
show name
show vpn-sessiondb l2l
Thanks!

im looking for the solution ? did u ever find out if this was possible?

Using multiple variable names in a for statement?

I have searched, and I just can't seem to find how to do something, I do not have the code atm, but easy enough to explain...
I have a GUI that has 3 rows of 3 fields...
emp1Name, emp1Phone, emp1Fax
emp2Name, emp2Phone, emp2Fax
emp3Name, emp3Phone, emp3Fax
I also have a tabbed file that has the input for each of these fields, it looks something like...
Mike 602-111-1111 602-111-1112
Dave 602-222-2222 602-222-2223
Bethany 602-333-3333 602-333-3334
Here is my method...
    private void getFile() {
        myFile = new File("C:/javainput.txt");
        msgField.setText("Welcome!");
        try {
            BufferedReader br = new BufferedReader(new FileReader(myFile));
            String s;
            while ((s=br.readLine())!=null){
                String f[] = s.split("\t");
                emp1Name.setText(f[0]);
                emp1Phone.setText(f[1]);
                emp1Fax.setText(f[2]);
            br.close();
        } catch (IOException e) {
            msgField.setText("INPUT FILE NOT FOUND!");
    }My question is, how do I cycle through emp1, emp2 and emp3 in a for statement. I tried empName, but that obviously isn't correct.
Help, or point me to where I can read on this?
Thank you!
Edited by: 805764 on Oct 27, 2010 12:10 PM

Do one thing at a time. First, define your Employee class. Compile it, debug it. Test it. Make sure that you can create Employees, set their names, phone numbers, etc., and get them back.
Once that works, familiarize yourself with arrays, if necessary, completely separately from your Employee class.
Once you're comfortable with arrays and with defining a new class (i.e., Employee), write a tiny test program that just, say, creates an array of a certain size and populates it with Employees, and then iterates over it printing out each Employee's information to the console.
Once that works, set it aside. Now work on a GUI. Start by just displaying one or two hardcoded names and phone numbers. Once that works, add a bit more to it--say by getting that hardcoded information from inside Employee objects.
And so on.
Right now you're biting off too much at once. Keep working on one very small new step at a time, only move on to the next step once the previous one is solid, and do the steps independently of each other first, and then combine their respective results. It may sound like a lot of work, but I promise you, in the end, it's faster, easier, and far less frustrating to do it this way.
At any given step, if you get stuck, post a question here, providing an [url http://sscce.org]SSCCE that shows what you're trying to do, and clearly explain exactly what problems you're having.

Cisco ASA and DNS

We purchased a bunch of Cisco ASA 5505 for our branch offices. Offices are made up of less than 20 end points. We are using it as a firewall and DHCP server at hte moment but also assumed that it had DNS server capabilities. Basically use it as a SOHO router. My research thus far indicates that yes we can use the device as a dns server but it won't resolve locally defined hosts. So it can relay dns request to an external dns server but won't allow me to configured an a record on the device itself.
Can anyone verify this before I look into purchasing another device just to do local DNS server services?
Thanks!

Joe
As far as i know the ASA cannot act as a DNS server nor can it act as a DNS relay. What you can do is -
1) configure DNS servers on the ASA that can be used in certain situations for allowing the ASA to resolve a name to an IP. For example using the Botnet filter on the ASA, SSL certificates etc. require the ASA to be able to qurey external DNS servers.
But this is for use by the ASA itself ie. it is used to resolve names within the ASA config. It is not used to allow clients to ask the ASA to resolve DNS names for them. So it can neither act as a DNS server itself nor can it pass on clients DNS queries to DNS servers.
2) if you use the ASA to hand out IPs via DHCP you can add valid DNS servers within the DHCP config just as you can with Windows DHCP.
Jon

Dynamic Routing Protocol Support in Cisco ASA Multiple Context Mode

                   Dear Experts,
Wold like to know whether dynamic Routing Protocol Support in Cisco ASA Firewall Multiple Context Mode. If yes then please provide OS version and Hardware Model of Cisco ASA Firewall. Appreciate the quick response. Thanks.

Hi,
Check out this document for the information
http://www.cisco.com/en/US/docs/security/asa/roadmap/asa_new_features.html#wp93116
Its lists the following for software level 9.0(1)
Multiple   Context Mode Features
Dynamic routing in Security   Contexts
EIGRP and OSPFv2 dynamic   routing protocols are now supported in multiple context mode. OSPFv3, RIP, and multicast routing   are not supported.
Seems to me you would need some 9.x version to support the above mentioned Dynamic Routing Protocols.
I don't think its related to the hardware model of the ASA other than that it requires a model that supports Multiple Context Mode. To my understanding the only model that doesnt support that is ASA5505 of the whole ASA5500 and ASA5500-X series.
Hope this helps
- Jouni

The DNS name that you specified is already in use.

Hi,
I am a new in Windows Azure. Can You help me please?
When I try to create new VM and input samething in DNS box, I get this message "The DNS name that you specified is already in use."
I have tried many random texts, but without success.
Pls help me.
Thank You

Hi
In some regions, existing storage accounts cannot be used to create virtual machines. It would be best to create a new one in the region that you want the VM in.
As you tried creating a VM, a cloud service would have been created using the dns name that you specified. Take a look at the Cloud Services tab and then delete the appropriate service. This should free up the dns name and you should be able to reuse it.
You might have to wait for the dns name to free up after the cloud service has been deleted though.

ACE 4710 use dns name in real server

Is there any way to use a DNS name in real server and not a static IP.

Hi,
This is not possible at the moment. With ACE EOL, i don't think it would be added either.
Regards,
Kanwal
Note: Please mark answers if they are helpful.

Cisco ASA SLA monitoring

I'm trying to configure an SLA on some of our ASAs and I want to monitor the hostname of a destination rather than the IP address. The CLI gives me an option to enter IP or hostname, but when I try and use a name rather than an IP address I get:
(config-sla-monitor)# type echo protocol ipIcmpEcho ?
sla-monitor mode commands/options:
Hostname or A.B.C.D IP address or hostname
(config-sla-monitor)# type echo protocol ipIcmpEcho google.com
^
ERROR: % Invalid Hostname
(config)# ping google.com
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 173.194.37.128, timeout is 2 seconds:
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/46/50 ms
Any ideas or suggestions? I've tried local hostnames just to make sure it wasn't a resolution issue. Substituting with the IP address works fine. We just have a particluar vendor we depend on that has a propensity to change IP addresses to a cloud app we depend on and not tell us.
If this posts answers your question or is helpful, please consider rating it and/or marking as answered.

Hi,
Always used the IP address so I have no previous expirience of configuring with hostname.
The Command Reference is very vague with regards to the definition of the hostname.
Initially I thought that he problem might be that the DNS lookups are not enabled on the ASA so it is not able to determine the IP address itself.
This didnt seem to make a difference.
Then I configured the following
name 1.1.1.1 test
After which it accepted the command with the hostname configured as "test".
So I am guessing the hostname refers to the "name" configurations of the ASA and if that is the case then I would consider it a pretty useless option.
I tried to configure an "object network GOOGLE" that uses "fqdn www.google.com" but it doesnt accept this "object" as the value for the hostname. So I am not really sure if I am missing something with regards to what else could be entered there other than something referenced in the "name" configuration.
On a quick search I could not find anything online in which someone is actually using a hostname instead of the IP address.
Also slightly adding to the confusion is the fact that the Configuration Guide makes no mention of hostname when giving instructions on configuring the target which to monitor for route tracking.
Starting to seem to me that there is no option to use a DNS name as the target for monitoring.
- Jouni

EJB lookup in a cluster (DNS names to servers mapping)

          I am using weblogic6.0 to setup a object clusters. Currently I have 2 physical
          machine each running one object server.
          I have a servlet in the web tier (it is not part of the cluster) that lookups
          the EJB's.
          From the documentation, I understand intialContext lookup should use one DNS name
          that maps to both the object servers.
          My question is how can I setup that ?
          - I tried the following, I am not sure if this is right
          I created a virtualhost with
          name: MyVirtualHost
          virtual host names : MyCluster (this is name of the cluster I had setup )
          Targets : MyCluster
          I tried looking up with
          t3//MyVirtualHost:7001 and t3//MyCluster:7001
          No luck in both the cases !!!!!
          Note : I restarted my weblogic servers after
          creating the virtual host. But I did not reboot my machine ( don't know if this
          is required )
          Please help !!!!
          Thanks
          Abi -


          You need add an entry in Domain Name Server to include your host1 and host2, and
          use it in your JNDI lookup. Or you can do:
          t3://host1,host2:7001
          Both ways should work. Will load balancing to two JNDI trees.
          Jim Zhou.
          "Abinesh Puthenpurackal" <[email protected]> wrote:
          >
          >I am using weblogic6.0 to setup a object clusters. Currently I have 2
          >physical
          >machine each running one object server.
          >
          >I have a servlet in the web tier (it is not part of the cluster) that
          >lookups
          >the EJB's.
          >
          >From the documentation, I understand intialContext lookup should use
          >one DNS name
          >that maps to both the object servers.
          >
          >My question is how can I setup that ?
          > - I tried the following, I am not sure if this is right
          > I created a virtualhost with
          > name: MyVirtualHost
          > virtual host names : MyCluster (this is name of the cluster I had
          >setup )
          > Targets : MyCluster
          >
          >I tried looking up with
          >t3//MyVirtualHost:7001 and t3//MyCluster:7001
          >
          >No luck in both the cases !!!!!
          >
          >Note : I restarted my weblogic servers after
          >creating the virtual host. But I did not reboot my machine ( don't know
          >if this
          >is required )
          >
          >Please help !!!!
          >
          >Thanks
          >Abi -
          >

Cisco ASA using Multiple DNS Names

Similar Messages

Maybe you are looking for