| 9.3 |  | Configuring DNS Support |
| 9.3.4 |  | DNS record translation |

| PIX Security Appliance software version 6.2 introduces full support for network address translation of DNS messages. The messages will originate from either inside interfaces, which are more secure, or outside interfaces, which are less secure.

This means that if a client on an inside network requests DNS resolution of an inside address from a DNS server on an outside interface, the DNS A-Record is translated correctly. It is no longer necessary to use the alias command to perform DNS doctoring. The PIX Security Appliance translates the DNS A-Record on behalf of the alias command.

In Figure , the client on the inside network issues an HTTP request to server 10.0.0.10, using its hostname cisco.com. The PIX Security Appliance translates the Web non-routable source address of the Web client in the IP header and forwards the request to the DNS server on its outside interface. When the DNS A-Record is returned, the PIX Security Appliance applies address translation not only to the destination address, but also to the embedded IP address of the Web server. This address is contained in the user data portion of the DNS reply packet. As a result, the Web client on the inside network gets the address it needs to connect to the Web server on the inside network.

NAT of DNS messages is implemented in both the nat and static commands.