| 9.3 |  | Configuring DNS Support |
| 9.3.1 |  | Overview of the alias command |

| The alias command has two possible functions. They are doctoring of DNS replies from an external DNS server and Destination NAT (dnat). With DNS doctoring, the PIX Security Appliance translates the IP address in a DNS response from a DNS server. In this case, the address being translated is the address embedded in the A-Record for the host whose name is being resolved by the DNS server. DNS doctoring is necessary when an internal client needs to connect to an internal server by its hostname and the DNS server is on the outside of the PIX Security Appliance.

On the other hand, with dnat the PIX Security Appliance translates the destination IP address of an application call. This is necessary when administrators want an application call from an internal client to a server in a perimeter network to use the external IP address of the server . This does not doctor the DNS replies.

Both of these will be discussed in this section in greater detail.

Figure examines the alias command and its syntax.