簡介
本文檔介紹在嘗試建立或加入集群時，如果DNS指標(PTR)記錄不可用，思科郵件安全裝置(ESA)何時出現「超時」錯誤，以及如何解決此問題。
必要條件
本文中的資訊係根據以下軟體和硬體版本：
- AsyncOS for Email Security版本8.0及更高版本
背景資訊
使用集群通訊安全(CSS)或安全外殼(SSH)透過IP地址加入集群時，需要PTR記錄，否則ESA將提示「超時」錯誤，並且集群加入將失敗。
有時，為了正確建立PTR記錄，DNS記錄更改可能是不可能或不允許的。
下列情況可能適用：
- 裝置的IP地址使用內部IP地址
- 兩台裝置都沒有PTR記錄
- 根DNS或本地DNS無法解析兩個本地主機名
- 無法編輯或修改根DNS或本地DNS
- 埠22 (SSH)和埠2222 (CSS)在兩端均打開
- 兩端都收到「超時」錯誤
- 無法在根DNS上為這些IP地址配置NXDOMAIN
設定
有一種解決方法是使用本地ESA作為DNS源。 從裝置CLI增加本地DNS解析。例如，如果存在無法解析PTR記錄的裝置esa1.example.com (192.168.10.1)和esa2.example.com (192.168.10.2)，請執行以下操作：
esa1.example.com> dnsconfig
Choose the operation you want to perform:
- NEW - Add a new server.
- EDIT - Edit a server
- DELETE - Remove a server
- SETUP - Configure general settings.
[]> new
Currently using the local DNS cache servers:
1. Priority: 0 192.168.1.53
Do you want to add a new local DNS cache server or an alternate domain server?
1. Add a new local DNS cache server.
2. Add a new alternate domain server.
[]> 2
Please enter the domain this server is authoritative for. (Ex: "com").
[]> 2.10.168.192.in-addr.arpa [enter the in-addr-arpa which serves as PTR, in this example for esa2]
Please enter the fully qualified hostname of the DNS server for the domain
"1.10.10.10.in-addr.arpa".
(Ex: "dns.example.168.192.in-addr.arpa").
[]> esa1.example.com [enter the hostname of the ESA you are configuring this on]
Please enter the IP address of machinea.example.com.
[]> 192.168.10.1 [enter the IP of the ESA you are configuring this on]
esa2.example.com> dnsconfig
Choose the operation you want to perform:
- NEW - Add a new server.
- EDIT - Edit a server
- DELETE - Remove a server
- SETUP - Configure general settings.
[]> new
Currently using the local DNS cache servers:
1. Priority: 0 192.168.1.53
Do you want to add a new local DNS cache server or an alternate domain server?
1. Add a new local DNS cache server.
2. Add a new alternate domain server.
[]> 2
Please enter the domain this server is authoritative for. (Ex: "com").
[]> 1.10.168.192.in-addr.arpa [enter the in-addr-arpa which serves as PTR, in this example esa1]
Please enter the fully qualified hostname of the DNS server for the domain
"1.10.10.10.in-addr.arpa".
(Ex: "dns.example.168.192.in-addr.arpa").
[]> esa2.example.com [enter the hostname of the ESA you are configuring this on]
Please enter the IP address of machinea.example.com.
[]> 192.168.10.2 [enter the IP of the ESA you are configuring this on]
按<Enter>鍵，直到您進入主提示符，然後運行commit以儲存和啟用配置更改。
注意：在上述示例中，為請輸入此伺服器授權的域是反向DNS查詢或IP地址192.168.10.1和192.168.10.2。請確保已配置on esa1.example.com和esa2.example.com才能訪問IP地址。
意見