Contents

DNS commands· 2

display dns domain· 2

display dns host 2

display dns server 4

display dns server health status· 5

display dns snooping host 5

display ipv6 dns server 6

dns cache ttl 7

dns domain· 9

dns dscp· 9

dns fast-reply enable· 10

dns proxy enable· 11

dns server 11

dns snooping enable· 12

dns snooping log enable· 13

dns source-interface· 14

dns spoofing· 14

dns trust-interface· 15

ip host 16

ipv6 dns dscp· 17

ipv6 dns server 17

ipv6 dns spoofing· 18

ipv6 host 19

reset dns host 20

 

DNS commands

display dns domain

Use display dns domain to display the domain name suffixes.

Syntax

display dns domain [ dynamic ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

dynamic: Displays the domain name suffixes dynamically obtained through DHCP or other protocols. If you do not specify this keyword, the command displays the statically configured and dynamically obtained domain name suffixes.

Examples

# Display the statically configured and dynamically obtained domain name suffixes for the public network.

<Sysname> display dns domain

Type:

  D: Dynamic    S: Static

 

No.    Type   Domain suffix

1      S      com

2      D      net

Table 1 Command output

Field	Description
No.	Sequence number.
Type	Domain name suffix type: ·     S—A statically configured domain name suffix. ·     D—A domain name suffix dynamically obtained through DHCP or other protocols. ‌
Domain suffix	Domain name suffixes.

 

Related commands

dns domain

display dns host

Use display dns host to display information about domain name-to-IP address mappings.

Syntax

display dns host [ ip | ipv6 ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

ip: Specifies type A queries. A type A query resolves a domain name to the mapped IPv4 address.

ipv6: Specifies type AAAA queries. A type AAAA query resolves a domain name to the mapped IPv6 address.

Usage guidelines

If you do not specify the ip or ipv6 keyword, this command displays domain name-to-IP address mappings of both query types.

Examples

# Display domain name-to-IP address mappings of both query types.

<Sysname> display dns host

Type:

  D: Dynamic    S: Static

 

Total number: 3

No.  Host name       Interface    Type  TTL      QType IP Count IP addresses

1    sample.com                   D     3132     A     3         192.168.10.1

                                                                 192.168.10.2

                                                                 192.168.10.3

2    zig.sample.com               S     -        A     1        192.168.1.1

3    sample.net                   S     -        AAAA  1        FE80::4904:4448

Table 2 Command output

Field	Description
No.	Sequence number.
Host name	Domain name.
Interface	Name of the output interface.
Type	Domain name-to-IP address mapping type: ·     S—A static mapping configured by the ip host or ipv6 host command. ·     D—A mapping dynamically obtained through dynamic domain name resolution. ‌
TTL	Time in seconds that a mapping can be stored in the cache. For a static mapping, a hyphen (-) is displayed.
QType	Query type: A and AAAA.
IP Count	Number of IP addresses corresponding to the domain name.
IP addresses	Replied IP addresses: ·     For a type A query, the replied IP addresses are IPv4 addresses. ·     For a type AAAA query, the replied IP addresses are IPv6 addresses.

 

Related commands

ip host

ipv6 host

reset dns host

display dns server

Use display dns server to display IPv4 DNS server information.

Syntax

display dns server [ dynamic ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

dynamic: Displays IPv4 DNS server information dynamically obtained through DHCP or other protocols. If you do not specify this keyword, the command displays statically configured and dynamically obtained IPv4 DNS server information.

Examples

# Display IPv4 DNS server information for the public network.

<Sysname> display dns server

Type:

  D: Dynamic    S: Static

 

No. Type  IP address

1   S     202.114.0.124

2   S     169.254.65.125

Table 3 Command output

Field	Description
No.	Sequence number.
Type	DNS server type: ·     S—A manually configured DNS server. ·     D—DNS server information dynamically obtained through DHCP or other protocols. ‌
IP address	IPv4 address of the DNS server.

 

Related commands

dns server

display dns server health status

Use display dns server health status to display health status of DNS servers.

Syntax

display dns server health status

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display health status of DNS servers.

<Sysname> display dns server health status

No. DNS server           OutInterface     VPN name                        Status

1   1.1.1.1              -                vpn1                            Up

2   2::1                 -                                                Up

3   FE80::1              -                vpn1                            Up

Table 4 Command output

Field	Description
No.	Sequence number.
DNS server	Address of the DNS server.
OutInterface	Output interface of the DNS server. This field is displayed only when the DNS server address is a local IPv6 link address.
VPN name	VPN instance name. If this field is empty, the domain name rule is on the public network.
Status	Result of the health check: ·     Up—The DNS server is available. ·     Down—The DNS server is unavailable.

 

Related commands

health-check enable

display dns snooping host

Use display dns snooping host to display domain name-to-IP address mappings recorded by DNS snooping.

Syntax

display dns snooping host [ ip | ipv6 ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

ip: Specifies type A queries. A type A query resolves a domain name to the mapped IPv4 address.

ipv6: Specifies type AAAA queries. A type AAAA query resolves a domain name to the mapped IPv6 address.

Usage guidelines

If you do not specify the ip or ipv6 keyword, this command displays domain name-to-IP address mappings of both query types recorded by DNS snooping.

Examples

# Display domain name-to-IP address mappings of both query types recorded by DNS snooping.

<Sysname> display dns snooping host

Total number: 5

No.  Host name       Server           TTL      QType IP count IP addresses

1    a.example.com   8.8.8.8          3593     A     1        100.100.0.7

2    b.example.com   8.8.8.8          3595     A     2        100.100.0.8

                                                              100.100.0.9

3    c.example.com   8.8.8.8          3593     A     1        100.100.0.6

4    d.example.com   8.8.8.8          3597     AAAA  1        101:101::104

5    e.example.com   8.8.8.8          3597     AAAA  1        101:101::103

Table 5 Command output

Field	Description
No.	Sequence number.
Host name	Domain name.
Server	IP address of the DNS server.
TTL	Time in seconds that a mapping can be stored in the cache.
QType	Query type: A and AAAA.
IP count	Number of IP addresses corresponding to the domain name.
IP addresses	Replied IP addresses: ·     For a type A query, the replied IP addresses are IPv4 addresses. ·     For a type AAAA query, the replied IP addresses are IPv6 addresses.

 

Related commands

reset dns host

display ipv6 dns server

Use display ipv6 dns server to display IPv6 DNS server information.

Syntax

display ipv6 dns server [ dynamic ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

dynamic: Displays IPv6 DNS server information dynamically obtained through DHCP or other protocols. If you do not specify this keyword, the command displays the statically configured and dynamically obtained IPv6 DNS server information.

Examples

# Display IPv6 DNS server information for the public network.

<Sysname> display ipv6 dns server

Type:

  D: Dynamic    S: Static

 

No. Type  IPv6 address                             Outgoing Interface

1   S     2::2

Table 6 Command output

Field	Description
No.	Sequence number.
Type	DNS server type: ·     S—A manually configured DNS server. ·     D—DNS server information dynamically obtained through DHCP or other protocols. ‌
IPv6 address	IPv6 address of the DNS server.
Outgoing Interface	Output interface.

 

Related commands

ipv6 dns server

dns cache ttl

Use dns cache ttl to set the TTL value for DNS entries.

Use undo dns cache ttl to cancel the TTL configuration for DNS entries.

Syntax

dns cache ttl { maximum max-value | minimum min-value } *

undo dns cache ttl [ maximum | minimum ]

Default

The TTL value for DNS entries is the TTL value in the DNS reply.

Views

System view

Predefined user roles

network-admin

Parameters

maximum max-value: Specifies the maximum TTL value for DNS entries, in the range of 60 to 3600 seconds.

minimum min-value: Specifies the minimum TTL value for DNS entries, in the range of 60 to 3600 seconds. The value for the min-value argument must be smaller than that for the max-value argument.

Usage guidelines

The device periodically sends a DNS request to the DNS server according to the TTL for DNS entries, which consumes CPU resources. If the TTL value is too small, the device sends DNS requests frequently to the DNS server, which consumes more CPU resources. If the TTL value is too large, DNS mappings cannot be updated in time. To avoid such issues, you can use this command to set the TTL value for DNS entries.

By default, the DNS client obtains the TTL for the following DNS entries from the DNS reply:

·     DNS entries generated from DNS snooping.

·     Dynamic domain name resolution cache generated from the DNS server/DNS server group.

After you set the TTL value for DNS entries, the device specifies the TTL for DNS entries as follows:

·     If the TTL value in the DNS reply is smaller than the minimum TTL value, the device uses the minimum TTL value as the TTL for DNS entries. If the TTL value is greater than or equal to the minimum TTL value, the device uses the TTL value in the DNS reply as the TTL for DNS entries.

·     If the TTL value in the DNS reply is greater than the maximum TTL value, the device uses the maximum TTL value as the TTL for DNS entries. If the TTL value is smaller than or equal to the maximum TTL value, the device uses the TTL value in the DNS reply as the TTL for DNS entries.

After you execute this command, the configuration only takes effect on the subsequent DNS entries generated from DNS snooping and DNS server/DNS server group.

After you execute the undo dns cache ttl command, the current TTL for the existing DNS entries still works.

If you do not specify any keywords when you execute the undo dns cache ttl command, this command cancels all TTL configuration for DNS entries.

If you execute the dns cache ttl minimum, dns cache ttl maximum, or dns cache ttl minimum maximum command multiple times, the most recent configuration takes effect.

Examples

# Set the maximum TTL value for DNS entries to 3600 seconds and the minimum TTL value for DNS entries to 180 seconds.

<Sysname> system-view

[Sysname] dns cache ttl maximum 3600 minimum 180

Related commands

dns server

dns server-group

dns snooping enable

dns domain

Use dns domain to configure a domain name suffix.

Use undo dns domain to delete the specified domain name suffix.

Syntax

dns domain domain-name

undo dns domain domain-name

Default

No domain name suffix is configured. Only the provided domain name is resolved.

Views

System view

Predefined user roles

network-admin

Parameters

domain-name: Specifies a domain name suffix. It is a dot-separated, case-insensitive string that can include letters, digits, hyphens (-), underscores (_), and dots (.), for example, example.com. The domain name suffix can include a maximum of 253 characters, and each separated string includes no more than 63 characters.

Usage guidelines

For domain name resolution, the resolver automatically uses the suffix list to supply the missing part of an incomplete name entered by a user.

A domain name suffix applies to both IPv4 DNS and IPv6 DNS.

The system allows a maximum of 16 domain name suffixes for the public network.

Examples

# Configure domain name suffix com for the public network.

<Sysname> system-view

[Sysname] dns domain com

Related commands

display dns domain

dns dscp

Use dns dscp to set the DSCP value for DNS packets sent by a DNS client or DNS proxy.

Use undo dns dscp to restore the default.

Syntax

dns dscp dscp-value

undo dns dscp

Default

The DSCP value is 0 in DNS packets sent by a DNS client or DNS proxy.

Views

System view

Predefined user roles

network-admin

Parameters

dscp-value: Specifies the DSCP value in the range of 0 to 63.

Usage guidelines

The DSCP value of a packet specifies the priority level of the packet and affects the transmission priority of the packet. A bigger DSCP value represents a higher priority.

Examples

# Set the DSCP value to 30 for outgoing DNS packets.

<Sysname> system-view

[Sysname] dns dscp 30

dns fast-reply enable

Use dns fast-reply enable to enable DNS fast-reply.

Use undo dns fast-reply enable to disable DNS fast-reply.

Syntax

dns fast-reply enable

undo dns fast-reply enable

Default

DNS fast-reply is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

As DNS fast-reply can process a large number of DNS requests per second, use this feature in scenarios that require high DNS packet processing performance.

With this feature enabled, the device monitors the received DNS requests (only UDP packets are supported in the current software version). Then, it resolves the domain names in the requests, and works as follows.

1.     Searches for a match in the static domain name resolution table on the public network.

2.     Searches for a match in the static domain name resolution table in each VPN in alphabetical order.

3.     If a match is found, the device sends a DNS reply to the DNS client. If no match is found, the device forwards the query to the DNS server.

This command enables both IPv4 DNS fast-reply and IPv6 DNS fast-reply.

Examples

# Enable DNS fast-reply.

<Sysname> system-view

[Sysname] dns fast-reply enable

dns proxy enable

Use dns proxy enable to enable DNS proxy.

Use undo dns proxy enable to disable DNS proxy.

Syntax

dns proxy enable

undo dns proxy enable

Default

DNS proxy is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

This configuration applies to both IPv4 DNS and IPv6 DNS.

Examples

# Enable DNS proxy.

<Sysname> system-view

[Sysname] dns proxy enable

dns server

Use dns server to specify the IPv4 address of a DNS server.

Use undo dns server to remove the IPv4 address of a DNS server.

Syntax

dns server ip-address

undo dns server [ ip-address ]

Default

No DNS server IPv4 address is specified.

Views

System view

Interface view

Predefined user roles

network-admin

Parameters

ip-address: Specifies the IPv4 address of a DNS server. When you execute the undo form of the command in interface view, you must specify this argument.

Usage guidelines

The system allows a maximum of six DNS server IPv4 addresses for the public network.

If you do not specify an IPv4 address, the undo dns server command removes all DNS server IPv4 addresses for the public network.

Examples

# Specify DNS server IPv4 address 172.16.1.1.

<Sysname> system-view

[Sysname] dns server 172.16.1.1

# Specify DNS server IPv4 address 172.16.1.1 on VLAN-interface 2. ‌

<Sysname> system-view

[Sysname] interface vlan-interface 2

[Sysname-Vlan-interface2] dns server 172.16.1.1

Related commands

display dns server

dns snooping enable

Use dns snooping enable to enable DNS snooping.

Use undo dns snooping enable to disable DNS snooping.

Syntax

dns snooping enable [ authorizing ]

undo dns snooping enable

 

 

Default

DNS snooping is disabled.

Views

System view

Predefined user roles

network-admin

Parameters

authorizing: Provides the DNS snooping service for DNS requests from users in authorizing state.

Usage guidelines

Application scenarios

DNS snooping is applicable to scenarios where user traffic is filtered based on domain names.

Operating mechanism

Other modules (for example, the address object group module) can obtain the IP addresses corresponding to domain names through DNS snooping only after they send domain name subscription requests to the DNS module. Enabled with DNS snooping, the device monitors received DNS requests and replies, and works as follows:

·     If the domain name in a DNS request matches a subscribed domain name, the device records the DNS mapping after receiving the DNS reply, and reports the mapping to the corresponding module for traffic filtering.

·     If the domain name in a DNS request does not match any subscribed domain name, the device does not record the DNS mapping.

When the domain names subscribed to by other modules age out, the DNS module notifies the modules of deleting the corresponding DNS mappings to ensure accuracy.

Recommended configuration

In scenarios where user traffic is filtered based on domain names, the device queries the object group to determine whether to permit packets after each resolution. If all DNS packets need to be resolved, the device has low packet processing efficiency and lots of CPU resources are consumed.

To resolve such an issue, specify the authorizing keyword when you execute this command. Then, the device provides the DNS snooping service for DNS requests only from access users who have ACLs or redirect URLs in authorization attributes and permits DNS requests from other users.

Restrictions and guidelines

DNS snooping works only between the DNS client and DNS server, or the DNS client and DNS proxy.

The dns snooping enable and dns snooping enable authorizing commands are mutually exclusive.

The dns snooping enable authorizing command takes effect only when the DNS client and DNS snooping reside in the same LAN.

Examples

# Enable DNS snooping.

<Sysname> system-view

[Sysname] dns snooping enable

dns snooping log enable

Use dns snooping log enable to enable DNS snooping logging.

Use undo dns snooping log enable to disable DNS snooping logging.

Syntax

dns snooping log enable

undo dns snooping log enable

Default

DNS snooping logging is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

The DNS proxy searches the static domain name resolution table and dynamic domain name resolution cache after receiving a request.

·     If the requested information is found, the DNS proxy returns a DNS reply to the client.

·     If the requested information is not found, the DNS proxy sends the request to the designated DNS server.

Too many requests received at the same time will increase network load and affect the performance of the DNS proxy and DNS server.

To avoid this issue, you can configure DNS snooping on the device between the DNS client and DNS proxy, or the DNS client and DNS server. Also, you can configure the device to generate and send DNS snooping logs to the fast log module. The administrator can locate and troubleshoot issues based on the logs.

Examples

# Enable DNS snooping logging.

<Sysname> system-view

[Sysname] dns snooping log enable

dns source-interface

Use dns source-interface to specify the source interface for DNS packets.

Use undo dns source-interface to restore the default.

Syntax

dns source-interface interface-type interface-number

undo dns source-interface interface-type interface-number

Default

No source interface is specified for DNS packets. The device uses the primary IP address of the output interface of the matching route as the source IP address for a DNS request.

Views

System view

Predefined user roles

network-admin

Parameters

interface-type interface-number: Specifies an interface by its type and number.

Usage guidelines

This configuration applies to both IPv4 and IPv6.

In IPv4 DNS, the device uses the primary IPv4 address of the specified source interface as the source IP address of a DNS query. In IPv6 DNS, the device selects an IPv6 address of the specified source interface as the source IP address of a DNS query. The method of selecting the IPv6 address is defined in RFC 3484.

The system allows only one source interface for the public network. If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Specify VLAN-interface 2 as the source interface for DNS packets on the public network. ‌

<Sysname> system-view

[Sysname] dns source-interface vlan-interface 2

dns spoofing

Use dns spoofing to enable DNS spoofing and specify the IPv4 address for spoofing DNS requests.

Use undo dns spoofing to disable DNS spoofing.

Syntax

dns spoofing ip-address

undo dns spoofing ip-address

Default

DNS spoofing is disabled.

Views

System view

Predefined user roles

network-admin

Parameters

ip-address: Specifies the IPv4 address used to spoof DNS requests.

Usage guidelines

Use the dns spoofing command together with the dns proxy enable command.

DNS spoofing functions when the DNS proxy does not know the DNS server address or cannot reach the DNS server. It enables the DNS proxy to spoof DNS queries of type A by responding with the specified IPv4 address.

The system allows only one replied IPv4 address for the public network. If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Enable DNS spoofing for the public network and specify IPv4 address 1.1.1.1 for spoofing DNS requests.

<Sysname> system-view

[Sysname] dns proxy enable

[Sysname] dns spoofing 1.1.1.1

Related commands

dns proxy enable

dns trust-interface

Use dns trust-interface to specify a DNS trusted interface.

Use undo dns trust-interface to remove a DNS trusted interface.

Syntax

dns trust-interface interface-type interface-number

undo dns trust-interface [ interface-type interface-number ]

Default

No DNS trusted interface is specified.

Views

System view

Predefined user roles

network-admin

Parameters

interface-type interface-number: Specifies an interface by its type and number.

Usage guidelines

By default, an interface obtains DNS suffix and DNS server information from DHCP. A network attacker might act as the DHCP server to assign a wrong DNS suffix and DNS server address to the device. As a result, the device fails to obtain the resolved IP address or might get the wrong IP address. With the DNS trusted interface specified, the device only uses the DNS suffix and DNS server information obtained through the trusted interface to avoid attacks.

This configuration applies to both IPv4 DNS and IPv6 DNS.

You can configure a maximum of 128 DNS trusted interfaces on the device.

If you do not specify an interface, the undo dns trust-interface command removes all DNS trusted interfaces and restores the default.

Examples

# Specify VLAN-interface 2 as a DNS trusted interface. ‌

<Sysname> system-view

[Sysname] dns trust-interface vlan-interface 2

ip host

Use ip host to create a host name-to-IPv4 address mapping.

Use undo ip host to remove a host name-to-IPv4 address mapping.

Syntax

ip host host-name ip-address

undo ip host host-name ip-address

Default

No host name-to-IPv4 address mappings exist.

Views

System view

Predefined user roles

network-admin

Parameters

host-name: Specifies a host name, a case-insensitive string of 1 to 253 characters that can contain letters, digits, hyphens (-), underscores (_), and dots (.). A host name must meet the following requirements:

·     The host name string is separated by dots (.). Each separated part includes up to 63 characters.

·     The host name cannot start or end with a dot (.).

·     The host name cannot contain two consecutive dots (..).

ip-address: Specifies the IPv4 address of the host.

Usage guidelines

The system allows a maximum of 1024 host name-to-IPv4 address mappings for the public network.

For the public network, each host name maps to only one IPv4 address. If you execute this command multiple times, the most recent configuration takes effect.

Do not use the ping command parameter ip, -a, -c, -f, -h, -i, -m, -n, -p, -q, -r, -s, -t, -tos, or -v as the host name. For more information about the ping command parameters, see Network Management and Monitoring Command Reference.

Examples

# Map IPv4 address 10.110.0.1 to host name aaa for the public network.

<Sysname> system-view

[Sysname] ip host aaa 10.110.0.1

Related commands

display dns host

ipv6 dns dscp

Use ipv6 dns dscp to set the DSCP value for IPv6 DNS packets sent by an IPv6 DNS client or IPv6 DNS proxy.

Use undo ipv6 dns dscp to restore the default.

Syntax

ipv6 dns dscp dscp-value

undo ipv6 dns dscp

Default

The DSCP value is 0 in IPv6 DNS packets sent by an IPv6 DNS client or IPv6 DNS proxy.

Views

System view

Predefined user roles

network-admin

Parameters

dscp-value: Specifies the DSCP value in the range of 0 to 63.

Usage guidelines

The DSCP value of a packet specifies the priority level of the packet and affects the transmission priority of the packet. A bigger DSCP value represents a higher priority.

Examples

# Set the DSCP value to 30 for outgoing IPv6 DNS packets.

<Sysname> system-view

[Sysname] ipv6 dns dscp 30

ipv6 dns server

Use ipv6 dns server to specify the IPv6 address of a DNS server.

Use undo ipv6 dns server to remove the IPv6 address of a DNS server.

Syntax

ipv6 dns server ipv6-address [ interface-type interface-number ] [ priority priority ]

undo ipv6 dns server [ ipv6-address [ interface-type interface-number ] ]

Default

No DNS server IPv6 address is specified.

Views

System view

Predefined user roles

network-admin

Parameters

ipv6-address: Specifies the IPv6 address of a DNS server.

interface-type interface-number: Specifies the output interface by its type and number. If you do not specify an interface, the device forwards DNS packets out of the output interface of the matching route. Specify this argument if the IPv6 address of the DNS server is a link-local address. Do not specify this argument if the IPv6 address of the DNS server is a global unicast address.

priority priority-value: Specifies the DNS server priority. The value range for the priority-value argument is 1 to 255 and the default is 100. A smaller value indicates a higher priority.

Usage guidelines

Operating mechanism

The device sends a DNS query to the DNS servers in descending order of their priorities. If they have the same priority, the device sends the DNS query to the DNS servers in ascending order of their IPv6 addresses. You can edit the priority of DNS servers to change the DNS query sending order.

Restrictions and guidelines

The system allows a maximum of six DNS server IPv6 addresses for the public network.

If you do not specify an IPv6 address, the undo ipv6 dns server command removes all DNS server IPv6 addresses for the public network.

Examples

# Specify DNS server IPv6 address 2002::1 for the public network.

<Sysname> system-view

[Sysname] ipv6 dns server 2002::1

Related commands

display ipv6 dns server

ipv6 dns spoofing

Use ipv6 dns spoofing to enable DNS spoofing and specify the IPv6 address to spoof DNS requests.

Use undo ipv6 dns spoofing to disable DNS spoofing.

Syntax

ipv6 dns spoofing ipv6-address

undo ipv6 dns spoofing ipv6-address

Default

DNS spoofing is disabled.

Views

System view

Predefined user roles

network-admin

Parameters

ipv6-address: Specifies the IPv6 address used to spoof DNS requests.

Usage guidelines

Use the ipv6 dns spoofing command together with the dns proxy enable command.

DNS spoofing functions when the DNS proxy does not know the DNS server address or cannot reach the DNS server. It enables the DNS proxy to spoof DNS queries of type AAAA by responding with the specified IPv6 address.

The system allows only one replied IPv6 address for the public network. If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Enable DNS spoofing for the public network and specify IPv6 address 2001::1 for spoofing DNS requests.

<Sysname> system-view

[Sysname] dns proxy enable

[Sysname] ipv6 dns spoofing 2001::1

Related commands

dns proxy enable

ipv6 host

Use ipv6 host to create a host name-to-IPv6 address mapping.

Use undo ipv6 host to remove a host name-to-IPv6 address mapping.

Syntax

ipv6 host host-name ipv6-address

undo ipv6 host host-name ipv6-address

Default

No host name-to-IPv6 address mappings exist.

Views

System view

Predefined user roles

network-admin

Parameters

host-name: Specifies a host name, a case-insensitive string of 1 to 253 characters that can contain letters, digits, hyphens (-), underscores (_), and dots (.). A host name must meet the following requirements:

·     The host name string is separated by dots (.). Each separated part includes up to 63 characters.

·     The host name cannot start or end with a dot (.).

·     The host name cannot contain two consecutive dots (..).

ipv6-address: Specifies the IPv6 address of the host.

Usage guidelines

The system allows a maximum of 1024 host name-to-IPv6 address mappings for the public network.

For the public network, each host name maps to only one IPv6 address. If you execute this command multiple times, the most recent configuration takes effect.

Do not use the ping ipv6 command parameter -a, -c, -i, -m, -q, -s, -t, -tc, or -v as the host name. For more information about the ping ipv6 command parameters, see Network Management and Monitoring Command Reference.

Examples

# Map IPv6 address 2001::1 to host name aaa for the public network.

<Sysname> system-view

[Sysname] ipv6 host aaa 2001::1

Related commands

ip host

reset dns host

Use reset dns host to clear dynamic DNS entries.

Syntax

reset dns host [ ip | ipv6 ]

Views

User view

Predefined user roles

network-admin

Parameters

ip: Specifies type A queries. A type A query resolves a domain name to the mapped IPv4 address.

ipv6: Specifies type AAAA queries. A type AAAA query resolves a domain name to the mapped IPv6 address.

Usage guidelines

If you do not specify the ip or ipv6 keyword, the reset dns host command clears dynamic DNS entries of both query types.

Use this command to clear the following dynamic DNS entries:

·     Dynamic DNS entries on the DNS client.

·     Dynamic DNS entries on the device enabled with DNS snooping.

Examples

# Clear dynamic DNS entries of all query types for the public network.

<Sysname> reset dns host

Related commands

display dns host

dns snooping enable