djbdns || PIX || TCP/IP || Linux || M$ || Cisco

Hi all,

I have two specific questions and I need your kind help.

1-     I'm pretty confident of the answer of this one, yet I need to
be 100% sure. It's in regard of DNS and Cisco PIX 500 series
firewalls. In my solution the DNS server uses Gentoo Gnu/Linux OS with
the National Security Agency SELinux kernel. It uses professor's Dan
J. Bernstein djbdns package for its DNS operations. When the server is
placed behind a Cisco PIX 525 firewall it replies with the real IP of
any machine NATed on the firewall, even though only the private IP is
recorded in the data file of tinydns program (the DNS server). This
result is really cool and helps a lot, my questions: Is this a feature
of PIX or there is some thing wrong?

2-     This question is in regards to networking concepts and TCP/IP
concepts. I'm going to introduce the problem and what I think
regarding it, however I don't know the correct answer. The very DNS
machine in the first question was moved from the private IP range it
was in namely (222.22.1.0/24) to another private IP range
(172.31.12.0/24) where the OCS production servers are. The later IP
range is configured for a 6-port *VLAN* on a Cisco Catalyst 6506
Switch (layer-3 switch). The firewall IP is (222.22.1.18) and is
connected to *another VLAN* of the same switch. There is routing
between the two VLANs. The router interface IP for both VLAN 1 and
VLAN 6 are respectively, 222.22.1.253 and 172.31.12.253. When the DNS
server was placed in VLAN 1 (222.22.1.0/24), it used the firewall
(222.22.1.18) as its default gateway. However, it rejects to accept
222.22.1.18 to be its default gateway when it's placed in VLAN 6
(172.31.12.0/24); I guess this happens since there is no known route
to the other subnet. When I use 172.31.12.253 as the default gateway
the DNS machine can ping the firewall, however it's *not* connected to
the firewall. The network team says that the machine should accept
222.22.1.18 to be its default gateway even though the firewall is on
another VLAN since there is routing between the two VLANs. I could not
accept there argument since the machine is not a router and should
route any traffic to the router in case the destination is not on its
subnet, bit how it can reach a router that it can not reach in the
first place! As I mentioned earlier the machine itself did not accept
there argument too. The debate got stronger (the situation is getting
really exciting) when they brought a MS Windows 2000 Server machine
and placed it on VLAN 6 (172.31.12.0/24), when they configured he
machine to have 222.22.1.18 as a default gateway the machine accepted
it with no problems what so ever. I got confused, ether my
understating needs more improvement or Windows is not doing the right
thing. We tested the configuration on a SUN Solaris 9 and the Solaris
did not accept the configuration either. I suggested defining a
sub-interface on the firewall and placing it in VLAN 6; the network
team refused the suggestion and insisted that the problem is from the
machines OS. I'm really confused! Is what windows doing valuate
networking standards? Or is it Linux and Solaris which do not follow
the standards? or there is no valuation in both, but I miss something?
What is the right thing to do in this situation?

I appreciate your help and sorry for any inconvenience.

Respectfully,
   =E2=80=A2 Rayid R. Bahabri