![]() |
Table Of Contents
Information About VRF-Aware DNS
How to Configure VRF-Aware DNS
Defining a VRF Table and Assigning a Name Server to Enable VRF-Aware DNS
Mapping VRF-Specific Hostnames to IP Addresses
Configuring a Static Entry in a VRF-Specific Name Cache
Verifying the Name Cache Entries in the VRF Table
Configuration Examples for VRF-Aware DNS
VRF-Specific Name Server Configuration: Example
VRF-Specific Domain Name List Configuration: Example
VRF-Specific Domain Name Configuration: Example
VRF-Specific IP Host Configuration: Example
VRF-Aware DNS
The VRF-Aware DNS feature enables the configuration of a Virtual Private Network (VPN) routing and forwarding instance (VRF) table so that the domain name system (DNS) can forward queries to name servers using the VRF table rather than the named DNS server in the global IP address space. This feature allows DNS requests to be resolved within the appropriate Multiprotocol Label Switching (MPLS) VPN.
History for the VRF-Aware DNS Feature
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
Information About VRF-Aware DNS
•
How to Configure VRF-Aware DNS
•
Configuration Examples for VRF-Aware DNS
Information About VRF-Aware DNS
To configure the VRF-Aware DNS feature, you should understand the following concepts:
•
VRF Mapping and VRF-Aware DNS
Domain Name System
Domain Name System (DNS) is a standard that defines a domain naming procedure used in TCP/IP. A domain is a hierarchical separation of the network into groups and subgroups with domain names identifying the structure. The named groups consist of named objects, usually devices like IP hosts, and the subgroups are domains. DNS has three basic functions:
•
Name space: This function is a hierarchical space organized from a single root into domains. Each domain can contain device names or more specific information. A special syntax defines valid names and identifies the domain names.
•
Name registration: This function is used to enter names into the DNS database. Policies are outlined to resolve conflicts and other issues.
•
Name resolution: This function is a distributed client and server name resolution standard. The name servers are software applications that run on a server and contain the resource records (RRs) that describe the names and addresses of those entities in the DNS name space. A name resolver is the interface between the client and the server. The name resolver requests information from the server about a name. A cache can be used by the name resolver to store learned names and addresses.
A DNS server can be a dedicated device or a software process running on a device. The server stores and manages data about domains and responds to requests for name conflict resolutions. In a large DNS implementation, there can be a distributed database over many devices. A server can be a dedicated cache.
VRF Mapping and VRF-Aware DNS
To keep track of domain names, IP has defined the concept of a name server, whose job is to hold a cache (or database) of names appended to IP addresses. The cached information is important because the requesting DNS will not need to query for that information again, which is why DNS works well. If a server had to query each time for the same address because it had not saved any data, the queried servers would be flooded and would crash.
A gateway for multiple enterprise customers can be secured by mapping the remote users to a VRF domain. Mapping means obtaining the IP address of the VRF domain for the remote users. By using VRF domain mapping, a remote user can be authenticated by a VRF domain-specific AAA server so that the remote-access traffic can be forwarded within the VRF domain to the servers on the corporate network.
To support traffic for multiple VRF domains, the DNS and the servers used to resolve conflicts must be VRF aware. VRF aware means that a DNS subsystem will query the VRF name cache first, then the VRF domain, and store the returned RRs in a specific VRF name cache. Users are able to configure separate DNS name servers per VRF.
VRF-aware DNS forwards queries to name servers using the VRF table. Because the same IP address can be associated with different DNS servers in different VRF domains, a separate list of name caches for each VRF is maintained. The DNS looks up the specific VRF name cache first, if a table has been specified, before sending a query to the VRF name server. All IP addresses obtained from a VRF-specific name cache are routed using the VRF table.
How to Configure VRF-Aware DNS
This section contains the following tasks:
•
Defining a VRF Table and Assigning a Name Server to Enable VRF-Aware DNS
•
Mapping VRF-Specific Hostnames to IP Addresses
•
Configuring a Static Entry in a VRF-Specific Name Cache
•
Verifying the Name Cache Entries in the VRF Table
Defining a VRF Table and Assigning a Name Server to Enable VRF-Aware DNS
Perform this task to define a VRF table and assign a name server.
A VRF-specific name cache is dynamically created if one does not exist whenever a VRF-specific name server is configured by using the ip name-server vrf command option or a permanent name entry is configured by using the ip host vrf command option. The VRF name cache is removed whenever all name server and permanent entries in the VRF are disabled.
It is possible that multiple name servers are configured with the same VRF name. The system will send queries to those servers in turn until any of them responds, starting with the server that sent a response the last time.
SUMMARY STEPS
1.
enable
2.
configure terminal
3.
ip vrf vrf-name
4.
rd route-distinguisher
5.
exit
6.
ip name-server [vrf vrf-name] server-address1 [server-address2...server-address6]
7.
ip domain lookup
DETAILED STEPS
Mapping VRF-Specific Hostnames to IP Addresses
Perform this task to map VRF-specific hostnames to IP addresses.
SUMMARY STEPS
1.
enable
2.
configure terminal
3.
ip domain name [vrf vrf-name] name
or
ip domain list [vrf vrf-name] nameDETAILED STEPS
Configuring a Static Entry in a VRF-Specific Name Cache
Perform this task to configure a static entry in a VRF-specific name cache.
A VRF-specific name cache is dynamically created if one does not exist whenever a name server is configured for the VRF by using the ip name-server vrf command option or a permanent name entry is configured by using the ip host vrf command option. The VRF name cache is removed whenever all name server and permanent entries in the VRF are disabled.
SUMMARY STEPS
1.
enable
2.
configure terminal
3.
ip host [vrf vrf-name] name [tcp-port-number] address1 [address2...address8]
DETAILED STEPS
Verifying the Name Cache Entries in the VRF Table
Perform this task to verify the name cache entries in the VRF table.
SUMMARY STEPS
1.
enable
2.
show hosts [vrf vrf-name] {all | hostname} [summary]
3.
clear host [vrf vrf-name] {all | hostname}
DETAILED STEPS
Configuration Examples for VRF-Aware DNS
This section provides the following configuration examples:
•
VRF-Specific Name Server Configuration: Example
•
VRF-Specific Domain Name List Configuration: Example
•
VRF-Specific Domain Name Configuration: Example
•
VRF-Specific IP Host Configuration: Example
VRF-Specific Name Server Configuration: Example
The following example shows how to specify a VPN named vpn1 with the IP addresses of 172.16.1.111 and 172.16.1.2 as the name servers:
ip name-server vrf vpn1 172.16.1.111 172.16.1.2VRF-Specific Domain Name List Configuration: Example
The following example shows how to add several domain names to a list in vpn1 and vpn2. The domain name is only used for name queries in the specified VRF.
ip domain list vrf vpn1 company.comip domain list vrf vpn2 school.eduIf there is no domain list, the domain name that you specified with the ip domain name global configuration command is used. If there is a domain list, the default domain name is not used. The ip domain list command is similar to the ip domain name command, except that with the ip domain list command you can define a list of domains, each to be tried in turn until a match is found.
VRF-Specific Domain Name Configuration: Example
The following example shows how to define cisco.com as the default domain name for a VPN named vpn1. The domain name is only used for name queries in the specified VRF.
ip domain name vrf vpn1 cisco.comAny IP hostname that does not contain a domain name (that is, any name without a dot) will have the dot and cisco.com appended to it before being looked up.
VRF-Specific IP Host Configuration: Example
The following example shows how to define two static hostname-to-address mappings in the host cache for vpn2 and vpn3:
ip host vrf vpn2 host2 10.168.7.18ip host vrf vpn3 host3 10.12.0.2Additional References
The following sections provide references related to the VRF-Aware DNS feature.
Related Documents
Standards
Standards TitleNo new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.
—
MIBs
RFCs
RFCs TitleNo new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.
—
Technical Assistance
Command Reference
This section documents modified commands only.
clear host
To delete entries from the hostname-to-address cache, use the clear host command in EXEC mode.
clear host [vrf vrf-name] {all | hostname}
Syntax Description
vrf vrf-name
(Optional) Virtual Private Network (VPN) routing and forwarding (VRF).
all
Removes all entries.
hostname
Particular hostname to remove.
Command Modes
EXEC
Command History
Release Modification10.0
This command was introduced.
12.4(4)T
The vrf keyword, vrf-name argument, and all keyword were added.
Usage Guidelines
The host name entries will not be removed from NVRAM, but will be cleared in running memory.
Examples
The following example shows how to clear all entries from the hostname-to-address cache:
Router> clear host allThe following example shows how to clear all entries from the hostname-to-address cache in the VPN name vpn1:
Router> clear host vrf vpn1Related Commands
ip domain list
To define a list of default domain names to complete unqualified names, use the ip domain list command in global configuration mode. To delete a name from a list, use the no form of this command.
ip domain list [vrf vrf-name] name
no ip domain list [vrf vrf-name] name
Syntax Description
Defaults
No domain names are defined.
Command Modes
Global configuration
Command History
Release Modification10.0
This command was introduced.
12.2
The syntax of the command changed from ip domain-list to ip domain list.
12.4(4)T
The vrf keyword and vrf-name argument were added.
Usage Guidelines
If there is no domain list, the domain name that you specified with the ip domain name global configuration command is used. If there is a domain list, the default domain name is not used. The ip domain list command is similar to the ip domain name command, except that with the ip domain list command you can define a list of domains, each to be tried in turn until the system finds a match.
If the ip domain list vrf command option is specified, the domain names are only used for name queries in the specified VRF.
The Cisco IOS software will still accept the previous version of the command, ip domain-list.
Examples
The following example shows how to add several domain names to a list:
ip domain list company.comip domain list school.eduThe following example shows how to add several domain names to a list in vpn1 and vpn2:
ip domain list vrf vpn1 company.comip domain list vrf vpn2 school.eduRelated Commands
ip domain name
To define a default domain name that the Cisco IOS software uses to complete unqualified hostnames (names without a dotted-decimal domain name), use the ip domain name command in global configuration mode. To disable use of the Domain Name System (DNS), use the no form of this command.
ip domain name [vrf vrf-name] name
no ip domain name [vrf vrf-name] name
Syntax Description
Defaults
Enabled
Command Modes
Global configuration
Command History
Release Modification10.0
This command was introduced.
12.2
The syntax of the command changed from ip domain-name to ip domain name.
12.4(4)T
The vrf keyword and vrf-name argument were added.
Usage Guidelines
Any IP hostname that does not contain a domain name (that is, any name without a dot) will have the dot and cisco.com appended to it before being added to the host table.
If the ip domain name vrf command option is specified, the domain names are only used for name queries in the specified VRF.
The Cisco IOS software will still accept the previous version of the command, which is ip domain-name.
Examples
The following example shows how to define cisco.com as the default domain name:
ip domain name cisco.comThe following example shows how to define cisco.com as the default domain name for vpn1:
ip domain name vrf vpn1 cisco.comRelated Commands
ip host
To define a static hostname-to-address mapping in the host cache, use the ip host command in global configuration mode. To remove the hostname-to-address mapping, use the no form of this command.
ip host [vrf vrf-name] {name | tmodem-telephone-number} [tcp-port-number] address1 [address2...address8]
no ip host [vrf vrf-name] {name | tmodem-telephone-number} [tcp-port-number] address1 [address2...address8]
Syntax Description
Defaults
Disabled
Command Modes
Global configuration
Command History
Usage Guidelines
The first character can be either a letter or a number. If you use a number, the types of operations you can perform (such as ping) are limited.
Examples
The following example shows how to define two static mappings:
ip host host2 10.168.7.18ip host host3 10.2.0.2 192.168.7.33The following example shows how to define two static hostname-to-address mappings in the host cache for vpn2 and vpn3:
ip host vrf vpn2 host2 172.16.3.1ip host vrf vpn3 host3 172.18.4.1The following example shows how to map modem telephone number 555-1234 to IP host address 10.1.5.5 for the Cisco modem user interface mode:
ip host t5551234 10.1.5.5ip name-server
To specify the address of one or more name servers to use for name and address resolution, use the ip name-server command in global configuration mode. To remove the addresses specified, use the no form of this command.
ip name-server [vrf vrf-name] server-address1 [server-address2...server-address6]
no ip name-server [vrf vrf-name] server-address1 [server-address2...server-address6]
Syntax Description
Defaults
No name server addresses are specified.
Command Modes
Global configuration
Command History
Examples
The following example shows how to specify IPv4 hosts 172.16.1.111 and 172.16.1.2 as the name servers:
ip name-server 172.16.1.111 172.16.1.2This command will be reflected in the configuration file as follows:
ip name-server 172.16.1.111ip name-server 172.16.1.2The following example shows how to specify IPv4 hosts 172.16.1.111 and 172.16.1.2 as the name servers for vpn1:
Router(config)# ip name-server vrf vpn1 172.16.1.111 172.16.1.2
The following example shows how to specify IPv6 hosts 3FFE:C00::250:8BFF:FEE8:F800 and 2001:0DB8::3 as the name servers:
ip name-server 3FFE:C00::250:8BFF:FEE8:F800 2001:0DB8::3This command will be reflected in the configuration file as follows:
ip name-server 3FFE:C00::250:8BFF:FEE8:F800ip name-server 2001:0DB8::3Related Commands
show hosts
To display the default domain name, the style of name lookup service, a list of name server hosts, the cached list of hostnames and addresses, and the cached list of hostnames and addresses specific to a particular Virtual Private Network (VPN), use the show hosts command in EXEC mode.
show hosts [vrf vrf-name] {all | hostname} [summary]
Syntax Description
Command Modes
EXEC
Command History
Usage Guidelines
If you specify the show hosts command without the optional keywords, only the entries in the global name cache will be displayed.
Examples
The following is sample output from the show hosts command:
Router# show hostsDefault domain is CISCO.COMName/address lookup uses domain serviceName servers are 255.255.255.255Host Flag Age Type Address(es)SLAG.CISCO.COM (temp, OK) 1 IP 172.20.4.10CHAR.CISCO.COM (temp, OK) 8 IP 192.168.7.50CHAOS.CISCO.COM (temp, OK) 8 IP 172.20.1.115DIRT.CISCO.COM (temp, EX) 8 IP 172.20.1.111DUSTBIN.CISCO.COM (temp, EX) 0 IP 172.20.1.27DREGS.CISCO.COM (temp, EX) 24 IP 172.20.1.30The following is sample output from the show hosts vrf command with a VRF name red specified:
Router# show hosts vrf redName lookup view: redDefault domain is red.comDomain list: red1.com, red2.comName/address lookup uses domain serviceName servers are 10.0.0.2, 10.0.0.3, 10.0.0.4Codes: UN - unknown, EX - expired, OK - OK, temp - temporary, perm - permanent NA - Not Applicable None - Not definedHost Port Flags Age Type Address(es) a.red.com None (temp, OK) 0 IP 10.0.0.2 printer.red.com None (perm, OK) 0 IP 10.0.0.5 10.0.0.7dns.red.com None (perm, OK) 0 IP 10.0.0.2Table 1 describes the significant fields shown in the display.
The following is sample output from a router when a modem telephone number is mapped to an IP host address for the Cisco modem user interface feature using the ip host global configuration command:
Router# show hostsDefault domain is not setName/address lookup uses domain serviceName servers are 255.255.255.255Codes: u - unknown, e - expired, * - OK, ? - revalidatet - temporary, p - permanentHost Age Type Address(es)*p p4085554567 0 IP 10.2.1.6*p t4085551234 0 IP 10.2.1.5Under the Host field, a "p" preceding the number indicates a pulse-dialed modem telephone number, and a "t" indicates a tone-dialed modem telephone number. The IP address mapped to the telephone number appears under the Address(es) field. See Table 1 for descriptions of the other fields seen in this display.
Related Commands
Command Descriptionclear arp interface
Deletes entries from the hostname-to-address cache.
ip helper-address
Defines a static host-name-to-address mapping in the host cache.
Copyright © 2005 Cisco Systems, Inc. All rights reserved.