Let’s Configure Domain name Server (DNS)

let’s configure DNS server.

Perform this task to configure the device as a DNS server. A Cisco IOS device can provide service to DNS clients, acting as both a caching name server and as an authoritative name server for its own local host table. When configured as a caching name server, the device relays DNS requests to other name servers that resolve network names into network addresses. The caching name server caches information learned from other name servers so that it can answer requests quickly, without having to query other servers for each transaction.

When configured as an authoritative name server for its own local host table, the device listens on port 53 for DNS queries and then answers DNS queries using the permanent and cached entries in its own host table. An authoritative name server usually issues zone transfers or responds to zone transfer requests from other authoritative name servers for the same zone. However, the Cisco IOS DNS server does not perform zone transfers.

When it receives a DNS query, an authoritative name server handles the query as follows:

1. If the query is for a domain name that is not under its zone of authority, the authoritative name server determines whether to forward the query to specific back-end name servers based on whether IP DNS-based hostname-to-address translation has been enabled via the ip domain lookup command.

2. If the query is for a domain name that is under its zone of authority and for which it has configuration information, the authoritative name server answers the query using the permanent and cached entries in its own host table.

3. If the query is for a domain name that is under its zone of authority but for which it does not have any configuration information, the authoritative name server does not forward the query elsewhere for a response; instead the authoritative name server simply replies that no such information exists.

STEPS:

Device>enable

Device#configure terminal

Device(config)#ip dns server
[Activates the DNS server on the device]

Device(config)#ip name-server server-address1 [server-address2... server-address6]
[Example: Device(config)# ip name-server 192.168.2.120 192.168.2.121 ]

Device(config)#ip dns server queue limit forwarder queue-size-limit
[Example: Device(config)# ip dns server queue limit forwarder 10] , [Configures a limit to the size of the queues used by the DNS server processes.]

Device(config)#ip host [vrf vrf-name] [view view-name] hostname {address1 [address2 ... address8] | additional address9 [address10 ... addressn]}
[Device(config)# ip host user1.example.com 192.168.201.5 192.168.201.6] [(Optional) Configures local hosts.]

Device(config)#ip dns primary domain-name soa primary-server-name mailbox-name [refresh-interval [retry-interval [expire-ttl [minimum-ttl]]]]
[Device(config)# ip dns primary example.com soa ns1.example.com mb1.example.com], [Configures the device as the primary DNS name server for a domain (zone) and as the start of authority (SOA) record source (which designates the start of a zone).]

Device(config)#ip host domain-name ns server-name
[Device(config)# ip host example.com ns ns1.example.com ], [(Optional) Configures the device to create an name server (NS) resource record to be returned when the DNS server is queried for the associated domain.]

Configuring DNS Spoofing

Perform this task to configure DNS spoofing. DNS spoofing is designed to allow a device to act as a proxy DNS server and “spoof” replies to any DNS queries using either the configured IP address in the ip dns spoofing ip-address command or the IP address of the incoming interface for the query. This feature is useful for devices where the interface toward the Internet service provider (ISP) is not up. Once the interface to the ISP is up, the device forwards DNS queries to the real DNS servers.

This feature turns on DNS spoofing and is functional if any of the following conditions are true:

• The no ip domain lookup command is configured.
• IP name server addresses are not configured.
• There are no valid interfaces or routes for sending to the configured name server addresses.

If these conditions are removed, DNS spoofing will not occur.

Device>enable

Device#configure terminal

Device#ip dns server

Device#ip dns spoofing [ip-address]
[Device(config)# ip dns spoofing 192.168.15.1], [Configures DNS spoofing.The IP address used for DNS spoofing can be an IPv4 or IPv6 address. The device will respond to the DNS query with the configured ip-address when queried for any hostname other than its own. The device will respond to the DNS query with the IP address of the incoming interface when queried for its own hostname.]

Mapping Hostnames to IP Addresses

Perform this task to map hostnames to IP addresses. A name server is used to keep track of information associated with domain names. A name server can maintain a database of hostname-to-address mappings. Each name can map to one or more IP addresses. In order to use this service to map domain names to IP addresses, you must specify a name server.

The name lookup system can be statically configured using the commands described in this task. Some other functions in Cisco IOS software, such as DHCP, can dynamically modify the state of the name lookup system. Use the show hosts command to display the cached hostnames and the DNS configuration.

Device>enable

Device#configure terminal

Device(config)#ip host name [tcp-port-number] address1 [address2 ... address8]
[Device(config)# ip host cisco-rtp 192.168.0.148], [Defines a static hostname-to-address mapping in the hostname cache. The host IP address can be an IPv4 or IPv6 address. Typically, it is easier to refer to network devices by symbolic names rather than numerical addresses (services such as Telnet can use hostnames or addresses). Hostnames and IP addresses can be associated with one another through static or dynamic means. Manually assigning hostnames to addresses is useful when dynamic mapping is not available.]

Device(config)# ip domain name [name]
[Device(config)# ip domain name cisco.com] , [Defines a default domain name that the Cisco IOS software will use to complete unqualified hostnames.]

OR,

ip domain list [name]
[Device(config)# ip domain list cisco1.com, [Defines a list of default domain names to complete unqualified hostnames.]

Device(config)#ip name-server server-address1 [server-address2 ... server-address6]
[Device(config)# ip name-server 172.16.1.111 172.16.1.2], [Specifies one or more hosts (up to six) that can function as a name server to supply name information for DNS.]

Device(config)#ip domain lookup [source-interface interface-type [interface-number]
[Device(config)# ip domain lookup], [ Enables DNS-based address translation. DNS is enabled by default. Use this command if DNS has been disabled.]