NSLOOKUP not returning the same thing on 2 PCs?

[Scott Townsend]

Why are these different? If I'm connecting via nslookup to a DNS server
outside the firewall it should return me the outside address. Its not, its
returning the inside.

Suggestions...
Thanks


This is the correct response from the DNS Server itself.
C:\WINDOWS\system32>nslookup
Default Server: ns1.healdsburg.net
Address: 206.13.44.2

www.eandm.com

Server: ns1.healdsburg.net
Address: 206.13.44.2

Name: www.eandm.com
Address: 204.145.245.177


This is what I get from a machine inside the firewall:
C:\WINDOWS\system32>nslookup
Default Server: server-ad3.haydon-mill.com
Address: 10.22.0.72

server 206.13.44.2

Default Server: ns1.healdsburg.net
Address: 206.13.44.2

www.enm.com

Server: ns1.healdsburg.net
Address: 206.13.44.2

Name: www.enm.com
Address: 10.1.1.177

 

[Ed Horley]

If you have a firewall that does DNS fixup it will convert DNS entries on
the fly to match NAT statements that exist on the firewall if turned on.
Cisco PIX will do this by default in 6.3(2) and better I believe. Some more
info from Cisco if you are interested.
http://www.cisco.com/en/US/products...on_guide_chapter09186a008017278b.html#1063720

What sort of firewall do you have?

Ed Horley
Microsoft MVP Server-Networking

 

[Jonathan de Boyne Pollard]

ST> Why are these different?

Because "www.enm.com." != "www.eandm.com.".

 

[Ace Fekay [MVP]]

In

Why are these different? If I'm connecting via nslookup to a DNS
server outside the firewall it should return me the outside address.
Its not, its returning the inside.

Suggestions...
Thanks


This is the correct response from the DNS Server itself.
C:\WINDOWS\system32>nslookup
Default Server: ns1.healdsburg.net
Address: 206.13.44.2

Server: ns1.healdsburg.net
Address: 206.13.44.2

Name: www.eandm.com
Address: 204.145.245.177


This is what I get from a machine inside the firewall:
C:\WINDOWS\system32>nslookup
Default Server: server-ad3.haydon-mill.com
Address: 10.22.0.72

Default Server: ns1.healdsburg.net
Address: 206.13.44.2

Server: ns1.healdsburg.net
Address: 206.13.44.2

Name: www.enm.com
Address: 10.1.1.177

This server you provided:

Server: ns1.healdsburg.net
Address: 206.13.44.2

Doesn't even respond for me. It appears either the DNS server is down or a
firewall is blocking traffic. Using my own server, I get the same IP address
for both www.enm.com and www.eandm.com. This is using one of Comcast's DNS
server:
==========================

www.eandm.com

Server: ns03.toresd01.pa.comcast.net
Address: 68.80.0.12

Name: www.eandm.com
Address: 204.145.245.177

www.enm.com

Server: ns03.toresd01.pa.comcast.net
Address: 68.80.0.12

Name: www.enm.com
Address: 204.145.245.177
==========================



Is 206.13.44.2 your WAN IP? Is so, Ed's response will apply in your case.


--
Regards,
Ace

Please direct all replies ONLY to the Microsoft public newsgroups
so all can benefit.

This posting is provided "AS-IS" with no warranties or guarantees
and confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft Windows MVP - Windows Server - Directory Services

Security Is Like An Onion, It Has Layers
HAM AND EGGS: A day's work for a chicken;
A lifetime commitment for a pig.

 

[Scott Townsend]

Thanks all for your reply. Yes we have a PIX with the DNS Fixup on it.
Just seemed like I was able to do it before... hmmm...

206.13.44.2 <ns1.healdsburg.net> is the address of our DNS Server. You
should be able to use NSLOOKUP on it from outside our Edge router. I can
try from my SBC DSL Connection when I get home...

Thanks for the clarification and tests...

Scott<-


"Ace Fekay [MVP]"

 

[Ace Fekay [MVP]]

In

Thanks all for your reply. Yes we have a PIX with the DNS Fixup on
it. Just seemed like I was able to do it before... hmmm...

206.13.44.2 <ns1.healdsburg.net> is the address of our DNS Server. You
should be able to use NSLOOKUP on it from outside our Edge router. I can
try from my SBC DSL Connection when I get home...

Thanks for the clarification and tests...

Scott<-

No prob Scott!

Ace

 

[Jonathan de Boyne Pollard]

ST> Why are these different?

JdeBP> Because "www.enm.com." != "www.eandm.com.".

EH> Good catch. Didn't notice that on the first read through. He
EH> should first check the same domain space prior to different ones!

MF> But they actually resolved to the same IP.

They did not in the output that Scott himself gave.

ST> Name: www.eandm.com
ST> Address: 204.145.245.177
ST> [...]
ST> Name: www.enm.com
ST> Address: 10.1.1.177