Usage Scenario

DNS provides static mappings between domain names and IP addresses. When IP addresses of interfaces change, DNS cannot dynamically update mappings. After the specified DDNS policy is applied on an interface, if the IP address of the interface changes, the DDNS policy updates mapping between the specified Fully Qualified Domain Name (FQDN) and the IP address.

If a DDNS policy with the same name is bound to an interface repeatedly and different FQDNs are specified, only the latest configuration takes effect and a DDNS update is initiated.

Prerequisites

To apply the policy on an interface, you need to create the DDNS policy first, also the DDNS policy, including DDNS Server domain-name, DDNS Client domain-name, username and password, must be completely configured.

To view information about the interfaces to which DDNS policies are applied, run the display ddns interface command.

You can run the display ddns policy command to view DDNS policy information. If no policy-name is specified, all DDNS policies information is displayed.

None

You can run the display dns domain command to view the configuration and sequence of domain name suffixes.

You can run the display dns dynamic-host command to view dynamic DNS entries saved in the domain name cache and check whether domain names match the mapping entries.

After DNS proxy or DNS relay is enabled, you can run the display dns forward table command to view the DNS table of IP addresses.

When the device receives DNS request packets from the client but does not receive DNS reply packets from the server, you need to run the display dns forward table command to view the DNS forwarding table.

You can use this command to check statistics on DNS packets, including the DNS IPv4 and IPv6 addresses.

After configuring DNS, run the display dns server command to view the configuration and sequence of current DNS servers.

After configuring static DNS entries, you can run the display ip host command to view the mapping between hosts and IP addresses.

DNS provides static mappings between domain names and IP addresses. When IP addresses of nodes change, DNS cannot dynamically update mappings. If a DNS client uses the original domain name to access the node, the DNS client will fail to access the node because the IP address mapping the domain name is incorrect. The DDNS updates the mappings between the domain name and the IP address on the DNS server to ensure that the IP address can be resolved correctly. The device can function as a DDNS client. When the IP address of the interface that provides services changes, the device sends a request of updating the domain name entry to the DDNS server. After receiving the request, the DDNS server updates the domain name entry.

Application Scenario

Precautions

A DNS client supports a maximum of 10 domain name suffixes. To configure multiple domain name suffixes, you can run the dns domain command repeatedly.

If the name of the suffix to be deleted is specified, the specified suffix is deleted. Otherwise, all the suffixes are deleted.

The mode for a device to select the destination DNS server can be auto and fixed. For how a device sends DNS request packets to the destination DNS server in each mode and the corresponding precautions, see dns-server-select-algorithm.

If the number of times for the device to retransmit DNS request packets to each destination DNS server is relatively large and the packet retransmission timeout period is relatively long, the time for the DNS client to wait for the response from the DNS server is too long. However, the request timeout period of the DNS client is shorter, so that the DNS client fails to properly receive response packets from the server. To enable the DNS server to rapidly respond DNS request packets, you can run the dns forward retry-number and dns forward retry-timeout commands to adjust the number of times for the device to retransmit DNS request packets to each DNS server and the packet retransmission timeout period for ensuring that the DNS client can properly receive response packets from the server.

The mode for a device to select the destination DNS server can be auto and fixed. For how a device sends DNS request packets to the destination DNS server in each mode and the corresponding precautions, see dns-server-select-algorithm.

If the number of times for the device to retransmit DNS request packets to each destination DNS server is relatively large and the packet retransmission timeout period is relatively long, the time for the DNS client to wait for the response from the DNS server is too long. However, the request timeout period of the DNS client is shorter, so that the DNS client fails to properly receive response packets from the server. To enable the DNS server to rapidly respond DNS request packets, you can run the dns forward retry-number and dns forward retry-timeout commands to adjust the number of times for the device to retransmit DNS request packets to each DNS server and the packet retransmission timeout period for ensuring that the DNS client can properly receive response packets from the server.

DNS proxy is used to forward DNS requests and reply packets between the DNS client and DNS server. The DNS client sends a DNS request packet to the device on which DNS proxy is enabled. The device sends the request packet to the DNS server and sends the reply packet to the DNS client. The device functions as the DNS proxy to provide services of the DNS server. Users do not need to interact with the DNS server directly. This function simplifies route deployment and improves performance and security of the DNS server.

This command applies only to the Branch Exchange Survivable Telephony (BEST) solution. In the BEST solution, the phone functions as the DNS client and the device functions as the DNS proxy. When the DNS client initiates an SRV query, the device inserts SIP server information to the DNS response packet. For example, when a Cisco phone is used and the dns proxy sip-info insert-mode decompression-domain-name command is not used to insert SIP server information to DNS response packets in domain name decompression mode, the phone cannot resolve DNS response packets that have SIP server information inserted.

DNS relay is used to forward DNS requests and reply packets between the DNS client and DNS server. The DNS client sends a DNS request packet to the device on which DNS relay is enabled. The device sends the request packet to the DNS server and sends the reply packet to the DNS client. The device functions as the DNS relay to provide services of the DNS server. Users do not need to interact with the DNS server directly. This function simplifies route deployment and improves performance and security of the DNS server.

To obtain IP addresses mapping domain names using the DNS server, run the dns resolve command to enable dynamic DNS resolution on the device.

Usage Scenario

A maximum of six DNS servers can be specified on Router. During dynamic DNS resolution, query messages are sent to DNS servers based on the configuration sequence of DNS servers.

The system sends a query to the DNS server first configured. If no response is received in the specified period of time (which can be configured by running the command dns forward retry-timeout), it resends the query twice. If receiving no response for the specified times (which can be configured by running the command dns forward retry-number), the system sends the query to the DNS server second configured and so on.

Prerequisites

If an interface on the device and the DNS server have reachable routes to each other and the interface is on a VPN network, the device must use the DNS server on the VPN network for DNS query so that DNS packets can be exchanged properly.

If you run this command multiple times, only the latest configuration takes effect.

The device can send DNS query requests to the DNS server on a public network or specified VPN network.

The device can respond to DNS query requests sent by DNS clients on multiple VPN networks.

Usage Scenario

When the device sends and receives DNS packets, the administrator can specify a source IP address for the device to ensure the communication security. The route from the DNS server to the specified source IP address must be reachable. The DNS server uses the specified source IP address as the destination address and sends a DNS response packet to the local device.

When the device functions as a DNS proxy or relay, run the dns server source-ip ip-address command to configure the source IP address for communicating with the DNS server.

Precautions

To make the command take effect, pay attention to the following points:

• Ensure that the source IP address is the IP address of an interface or logical interface on the device, and there are reachable routes between the interface and the DNS server.

• Ensure that the source IP address and the IP address of the DNS server are on the same VPN or public network.

If the DNS server address or route to the DNS server is not configured on the DNS proxy or relay, you can enable DNS spoofing on the device to spoof a response message with the configured IP address. Currently, DNS spoofing takes effect for only Class-A query (IP address query based on domain names).

If you run the dns spoofing command multiple times, only the latest configuration takes effect.

Usage Scenario

After the interval for sending DDNS update requests is set in the configured DDNS policy, the device is triggered to send DDNS update requests at the specified intervals. All the mappings between IP addresses and domain names defined in the DDNS policy are updated.

Precautions

• If you run the interval command multiple times, only the latest configuration takes effect.

• Regardless of whether the interval is reached, the device sends DDNS update requests immediately as long as the primary IP address of the corresponding interface changes or the link status of the interface changes from Down to Up.

• If the interval is changed, the device is triggered to send a DDNS update request immediately.

• When a device is connected to the DDNS server supporting www.oray.cn, this command does not take effect and the device initiates a DDNS update request at a fixed interval of 60 seconds.

Usage Scenario

A static domain name resolution table is manually set up using the ip host command, describing the mappings between host names and IP addresses. In addition, some common host names are added to the table. Then, static host name resolution can be performed according to the static domain name resolution table. When requiring the IP address corresponding to a host name, the client first searches the static host name resolution table for the specified host name and obtains the corresponding IP address. In this manner, the efficiency of host name resolution is improved.

Precautions

The ip host command configures a maximum of 50 static DNS entries. Each host name can be mapped to only one IP address. When multiple IP addresses are mapped to a host name, only the latest configuration takes effect.

Usage Scenario

When the device functions as a DDNS client and the update mode is DDNS, you can run the name-server command to configure a DNS server to receive update messages from the DDNS client. After receiving the update request packets, the DNS server updates the mapping between the domain name and IP address of the DDNS client. When deploying a DNS server on a private network, you need to specify the name of the VPN instance to which the DNS server belongs.

Prerequisites

The update mode of the device functioning as a DDNS client has been set to DDNS using the method (DDNS policy view) command.

After the reset ddns policy command is executed, all mappings between IP addresses and domain names defined in the DDNS policy are updated.

Clear dynamic DNS entries with caution because they cannot be restored after being cleared.

After confirming the action of clearing DNS entries, you can run the reset command to clear them.

When the Router as a DNS proxy or relay is attacked, the DNS table will be full. The reset dns forward table command can delete all DNS entries.

The reset dns statistics command clears statistics on DNS packets, including the DNS IPv4 and IPv6 addresses. The cleared statistics cannot be restored.

Usage Scenario

When the device functions as the DDNS client and communicates with a Siemens DDNS server, the device needs to encrypt packets using SSL. An SSL policy needs to be bound to the DDNS policy.

Prerequisites

An SSL policy has been created using the ssl policy policy-name [ type { client | server } ] command, and PKI domain to be used by the SSL policy has been configured using the pki-realm realm-name command.

A DDNS policy has been created using the ddns policy command and a URL has been configured for Siemens DDNS server using the url command.

Precautions

An SSL policy needs to be bound to the DDNS policy only when the device functions as the DDNS client and communicates with a Siemens DDNS server.

Usage Scenario

After a DDNS policy is created, enter the URL and specify a DDNS server in the URL.

Where,

• The URL uses the default port number. The default port number of the DDNS server provided at www.oray.cn is 6060, the default HTTP port number is 80 and the default HTTPS port number is 443.

• The FQDN and IP address cannot be specified in the URL for the DDNS server provided at www.oray.cn. You can specify the FQDN when applying a DDNS policy on an interface. The IP address in the URL is the primary IP address of the interface to which a DDNS policy is applied.

  To prevent configuration errors, you are advised not to change <h> or <a> in the URL. The device automatically fills in <h> and <a> based on the FQDN specified when a DDNS policy is bound to the interface.

If you run the url command multiple times, only the latest configuration takes effect.

Precautions

In a URL, the user name and password are separated using :, the password and domain name are separated using @, and the domain name ends with /. Pay attention to the following points when using special characters in a URL.

Usage Scenario

To control access traffic, the administrator requires that users can access only some websites on which they can browse only texts or pictures. For example, in Wi-Fi connection scenarios such as in metro or on bus, passengers can access only specified websites. If they attempt to access other websites, their access requests are rejected or redirected to the specified websites.

The administrator can run the dns resolve policy a command to enable the DNS resolution policy function for class-A query requests. Then only some specified domain names can be resolved to meet the wireless connection requirements.

Follow-up Procedure

Run the rule (DNS resolution policy view) command to configure a DNS resolution rule.

Usage Scenario

After the DNS resolution policy function is enabled, you need to configure a resolution rule in the DNS resolution policy view to implement domain name resolution, resolution prohibition, and spoofing response for a specified domain name.

The administrator can run the rule command to configure a specified DNS resolution rule.

Prerequisites

The DNS resolution policy function for class-A query requests has been enabled and the DNS resolution policy view has been displayed using the dns resolve policy a command.

Precautions

• If the rule ID specified in rule-id already exists, the new rule overwrites the original rule no matter whether the new and original rules conflict with each other.
• If the specified rule-id does not exist, create a rule using the specified rule-id and determine the rule insertion position based on the rule size.