简介
本文档介绍在尝试创建或加入集群时，如果DNS指针(PTR)记录不可用，思科邮件安全设备(ESA)何时出现“超时”错误，以及如何解决此问题。
先决条件
本文档中的信息基于以下软件和硬件版本：
- AsyncOS for Email Security版本8.0及更高版本
背景信息
使用集群通信安全(CSS)或安全外壳(SSH)通过IP地址加入集群时，需要PTR记录，否则ESA将提示“超时”错误，集群加入将失败。
有时，为了正确创建PTR记录，DNS记录更改可能是不可能或不允许的。
以下情况可能适用：
- 设备的IP地址使用内部IP地址
- 两台设备没有PTR记录
- 根DNS或本地DNS无法解析两个本地主机名
- 无法编辑或修改根DNS或本地DNS
- 端口22 (SSH)和端口2222 (CSS)在两端均打开
- 两端都出现“超时”错误
- 无法在根DNS上为这些IP地址配置NXDOMAIN
配置
可以使用本地ESA作为DNS源的解决方法。 从设备CLI添加本地DNS解析。例如，如果有无法解析PTR记录的设备esa1.example.com (192.168.10.1)和esa2.example.com (192.168.10.2)，请执行以下操作：
esa1.example.com> dnsconfig
Choose the operation you want to perform:
- NEW - Add a new server.
- EDIT - Edit a server
- DELETE - Remove a server
- SETUP - Configure general settings.
[]> new
Currently using the local DNS cache servers:
1. Priority: 0 192.168.1.53
Do you want to add a new local DNS cache server or an alternate domain server?
1. Add a new local DNS cache server.
2. Add a new alternate domain server.
[]> 2
Please enter the domain this server is authoritative for. (Ex: "com").
[]> 2.10.168.192.in-addr.arpa [enter the in-addr-arpa which serves as PTR, in this example for esa2]
Please enter the fully qualified hostname of the DNS server for the domain
"1.10.10.10.in-addr.arpa".
(Ex: "dns.example.168.192.in-addr.arpa").
[]> esa1.example.com [enter the hostname of the ESA you are configuring this on]
Please enter the IP address of machinea.example.com.
[]> 192.168.10.1 [enter the IP of the ESA you are configuring this on]
esa2.example.com> dnsconfig
Choose the operation you want to perform:
- NEW - Add a new server.
- EDIT - Edit a server
- DELETE - Remove a server
- SETUP - Configure general settings.
[]> new
Currently using the local DNS cache servers:
1. Priority: 0 192.168.1.53
Do you want to add a new local DNS cache server or an alternate domain server?
1. Add a new local DNS cache server.
2. Add a new alternate domain server.
[]> 2
Please enter the domain this server is authoritative for. (Ex: "com").
[]> 1.10.168.192.in-addr.arpa [enter the in-addr-arpa which serves as PTR, in this example esa1]
Please enter the fully qualified hostname of the DNS server for the domain
"1.10.10.10.in-addr.arpa".
(Ex: "dns.example.168.192.in-addr.arpa").
[]> esa2.example.com [enter the hostname of the ESA you are configuring this on]
Please enter the IP address of machinea.example.com.
[]> 192.168.10.2 [enter the IP of the ESA you are configuring this on]
按<Enter>键，直到进入主提示符并运行commit以保存和激活配置更改。
注意：在上述示例中，为请输入此服务器权威的域输入的域是反向DNS查找或IP地址192.168.10.1和192.168.10.2。请确保已配置IP地址on esa1.example.com和esa2.example.com并且这些地址可以访问。
反馈