DNS and NAT (IP Masquerading)

[Mike Pountney]

Hi all,

We are currently redesigning our internal network (multiple worldwide
sites, linked via VPN technology) and firewalls. We will be implementing
NAT as part of this process, to ease a lot of sticky client config
problems, and otherwise add functionality.

The problem we have is that our DNS infrastructure at present uses an
internal root zone, and as such will need some modification to be able
to resolve the external addresses that NAT requires.

Presumably many of you have come across this same problem, and have
found the best way to get around it. What did you do? What pitfalls did
you come across, and how did you get around them? Did you find NAT to be
of benefit in the solution (i.e. did you get any internal servers
talking to external servers)?

Any information would be appreciated, though from the recomendations in
DNS & BIND I would rather steer away from forwarding configs. Solutions
that involve many DNS servers, multiple sites, multiple parent domains
(we use osa.com, osa.com.au, and osa.de), and (o-my-gosh ;-) Micro$oft
DNS servers as well would be *very* well received.

Many thanks,

Mike
mike at osa.com.au