- Table of Contents
-
- 08-Configuration Examples
- 01-Web Login Configuration Examples
- 02-Internet Access Through a Static IP Address Configuration Examples
- 03-Internet access through PPPoE configuration examples
- 04-Signature Library Upgrade Configuration Examples
- 04-Software Upgrade Examples(only for F50X0-D and F5000-AK5X5 firewalls)
- 05-Software Upgrade Examples
- 06-Static routing configuration examples
- 07-OSPF configuration examples
- 08-BGP configuration examples
- 09-RIP configuration examples
- 10-DHCP configuration examples
- 11-DNS configuration examples
- 12-Object Group Configuration Examples
- 13-Public key management configuration examples
- 14-Security Policy Configuration Examples
- 15-Attack defense configuration examples
- 16-Connection Limit Configuration Examples
- 17-IPS Configuration Examples
- 18-URL Filtering Configuration Examples
- 19-Anti-Virus Configuration Examples
- 20-Data Filtering Configuration Examples
- 21-File Filtering Configuration Examples
- 22-APR-Based Security Policy Configuration Examples
- 23-Bandwidth Management Configuration Examples
- 24-NAT configuration examples
- 25-NAT hairpin configuration examples
- 26-IPsec configuration examples
- 27-SSL VPN configuration examples
- 28-Server Load Balancing Configuration Examples
- 29-Outbound Link Load Balancing Configuration Examples
- 30-Inbound Link Load Balancing Configuration Examples
- 31-Transparent DNS Proxy Configuration Examples
- 32-Context Configuration Examples
- 32-Context Configuration Examples(only for F50X0-D and F5000-AK5X5 firewalls)
- 33-IRF configuration examples
- 34-High Availability Group Configuration Examples
- 35-NAT Flow Logging Configuration Examples
- 36-User identification configuration examples
- 37-Server Connection Detection Configuration Examples
- 38-IP Reputation Configuration Examples
- 39-NPTv6 Configuration Examples
- 40-SSL Decryption Configuration Examples
- 41-MAC Address Learning Through a Layer 3 Device Configuration Examples
- 42-WAF Configuration Examples
- 43-NetShare Control Configuration Examples
- 44-4G Configuration Examples
- 45-WLAN Configuration Examples
- Related Documents
-
Title | Size | Download |
---|---|---|
11-DNS configuration examples | 151.51 KB |
Introduction
The following information describes DNS configuration examples.
This document is not restricted to specific software or hardware versions. Procedures and information in the examples might be slightly different depending on the software or hardware version of the device.
The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.
The following information is provided based on the assumption that you have basic knowledge of DNS.
Network configuration
As shown in Figure 1, Device A acts as the DNS proxy to relay DNS packets between DNS clients and the DNS server. DNS clients access the host with domain name host.com through the DNS proxy.
Software versions used
This configuration example was created and verified on F9345 of the F1060 device.
Restrictions and guidelines
Clear the DNS cache on the DNS proxy and DNS clients if the IP address of the DNS server changes or a domain name-to-IP address mapping changes.
Procedure
Configuring Device A
1. Assign IP addresses to interfaces and add the interfaces to security zones.
# On the top navigation bar, click Network.
# From the navigation pane, select Interface Configuration > Interfaces.
# Click the Edit icon for GE 1/0/1.
# In the dialog box that opens, configure the interface:
a. Select the Untrust security zone.
b. On the IPv4 Address tab, enter the IP address and mask of the interface. In this example, enter 172.16.100.1/24.
c. Click OK.
# Add GE 1/0/0 to the Trust security zone and set its IP address to 192.168.10.1/24 in the same way you configure GE 1/0/1.
2. Configure security policy dns-a.
# On the top navigation bar, click Policies.
# From the navigation pane, select Security Policies > Security Policies.
# Click Create and click Create a policy.
# In the dialog box that opens, configure policy parameters as follows:
a. Specify the policy name. In this example, the name is dns-a.
b. Select the source zone. In this example, the source zone is Trust.
c. Select the destination zone. In this example, the destination zone is Untrust.
d. Select IPv4 as the type.
e. Select Permit as the action.
f. Specify the IP address of the DNS client as the source IPv4 address. In this example, the address is 192.168.10.10/24.
g. Specify the IP address of the external host as the destination IPv4 address. In this example, the address is 3.3.3.4/24.
h. Click OK.
3. Configure security policy dns-b.
a. Specify the policy name. In this example, the name is dns-b.
b. Select the source zone. In this example, the source zone is Local.
c. Select the destination zone. In this example, the destination zone is Untrust.
d. Select IPv4 as the type.
e. Select Permit as the action.
f. Click OK.
4. Configure DNS proxy.
# On the top navigation bar, click Network.
# From the navigation pane, select DNS > Advanced Settings.
# Select Enable.
Figure 2 Enabling DNS proxy
5. Specify the IP address of the DNS server.
# On the top navigation bar, click Network.
# From the navigation pane, select DNS > DNS Client.
# Enter the IP address of the DNS server.
# Click the Add icon.
Figure 3 Specifying the DNS server
Configuring DNS clients
# Assign IP addresses to DNS clients and specify the IP address of the DNS server on DNS clients.
Verifying the configuration
1. Verify that each DNS client can successfully ping the host with domain name host.com.
C:\Users\abc>ping host.com
Pinging host.com [3.3.3.4] with 32 bytes of data:
Reply from 3.3.3.4: bytes=32 time<1ms TTL=253
Reply from 3.3.3.4: bytes=32 time<1ms TTL=253
Reply from 3.3.3.4: bytes=32 time<1ms TTL=253
Reply from 3.3.3.4: bytes=32 time<1ms TTL=253
Ping statistics for 3.3.3.4:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
2. Verify that Device A can successfully ping the host with domain name host.com.
# On the top navigation bar, click System.
# From the navigation pane, select Diagnosis Center > Ping.
# In the Destination IP address or hostname field, enter host. com, and click Start.
Figure 4 Ping operation
Network configuration
As shown in Figure 5, the device is a Web server with domain name whatever.3322.org and uses an IP address dynamically obtained through DHCP. To make sure the device can always provide Web services at whatever.3322.org when its IP address changes, perform the following tasks on the device:
· Configure a DDNS policy to update the device's domain name-to-IP address mapping on the DDNS server. The DDNS server then updates the mapping on the DNS server.
· Specify the IP address of the DNS server so that the device can access the DDNS server through domain name.
Software versions used
This configuration example was created and verified on F9345 of the F1060 device.
Prerequisites
Before configuring DDNS on the device, perform the following tasks:
· Register with username hell and password neve at http://www.3322.org/.
· Create a mapping between the device's FQDN and IP address on the DNS server.
Procedure
1. Configure security policy ddns-a.
# On the top navigation bar, click Policies.
# From the navigation pane, select Security Policies > Security Policies.
# Click Create and click Create a policy.
# In the dialog box that opens, configure policy parameters as follows:
a. Specify the policy name. In this example, the name is ddns-a.
b. Select the source zone. In this example, the source zone is Local.
c. Select the destination zone. In this example, the destination zone is Untrust.
d. Select IPv4 as the type.
e. Select Permit as the action.
f. Click OK.
2. Configure security policy ddns-b.
# On the top navigation bar, click Policies.
# From the navigation pane, select Security Policies > Security Policies.
# Click Create and click Create a policy.
# In the dialog box that opens, configure policy parameters as follows:
a. Specify the policy name. In this example, the name is ddns-b.
b. Select the source zone. In this example, the source zone is Untrust.
c. Select the destination zone. In this example, the destination zone is Local.
d. Select IPv4 as the type.
e. Select Permit as the action.
f. Click OK.
3. Specify the IP address of the DNS server.
# On the top navigation bar, click Network.
# From the navigation pane, select DNS > DNS Client.
# Add the IP address of the DNS server, as shown in Figure 6.
Figure 6 Specifying the DNS server
4. Configure a DDNS policy.
# From the navigation pane, select DNS > DDNS Policies.
# Click Create.
# In the dialog box that opens, create a DDNS policy, as shown in Figure 7.
Figure 7 Creating a DDNS policy
# Click OK.
Verifying the configuration
Verify that the device can update its domain name-IP mapping through the DDNS provider www.3322.org when its IP address changes. The Internet users can resolve the correct IP address through the domain name whatever.3322.org to access the Web service.