Split DNS

Order in Which to Check the Members of a DNS View List

When a DNS view list is used to select a DNS view for handling a given DNS query, the Cisco IOS software checks each member of the view list--in the order specified by the list--and selects the first view list member whose restrictions permit the view to be used with the query that needs to be handled.

Usage Restrictions Defined for a DNS View in the View List

A DNS view list member can be configured with usage restrictions defined using access control lists (ACLs) that specify rules for selecting that view list member based on the query hostname or the query source host IP address. The two types of ACLs supported by the Split DNS view list definition are described in "DNS Name Groups".

Note	Multiple DNS view lists can be defined so that, for example, a given DNS view can be associated with different restrictions in each list. Also, different DNS view lists can include different DNS views.

Selection of the DNS View List

When the router that is acting as the DNS caching name server needs to respond to a DNS query, the Cisco IOS software uses a DNS view list to determine which DNS view can be used to handle the query:

• If the router is responding to an incoming query that arrives on an interface for which a DNS view list is configured, the interface-specific DNS view list is used.
• If the router is responding to an incoming query that arrives on an interface for which no specific DNS view list is configured, the default DNS view list is used.

If the router is responding to an internally generated query, no DNS view list is used to select a view; the global DNS view is used to handle the query.

The assignment of a DNS view list as the default or to an interface is described in "DNS View Groups".

Selection of a DNS View List Member

The view list members are compared, each in turn, to the characteristics of the DNS query that the router is responding to:

1. If the query is from a different VRF than the view, the view cannot be used to address the query, so the view-selection process moves on to the next member of the view list.
2. The specification of additional view-use restrictions is an optional setting for any view list member.

If the query list does not specify additional restrictions on the view, the view will be used to address the query, so the view-selection process is finished.

If the view list does specify additional restrictions on the view, the query is compared to those restrictions:

• If the query characteristics fail any view-use restriction, the view cannot be used to address the query, so the view-selection process moves on to the next member of the view list.
• If the query characteristics pass all the view-use restrictions, the view will be used to address the query. The view-selection process is finished.
• If the view-selection process reaches the end of the selected DNS view list without finding a view list member that can handle the query, the router discards the query.

The first DNS view list member that is found to have restrictions that match the query characteristics is used to handle the query.

DNS View Usage Restrictions Based on the Query Hostname

A DNS name list is a named set of hostname pattern-matching rules, with each rule specifying the type of action to be performed if a query hostname matches the text string pattern in the rule. In order for a query hostname to match a name list, the hostname must match a rule that explicitly permits a matching pattern but the hostname cannot match any rules that explicitly deny a matching pattern.

DNS View Usage Restrictions Based on the Query Source IP Address

A standard IP ACL is a numbered or named set of host IP address-matching rules, with each rule specifying the type of action to be performed if an IP address matches the text string pattern in the rule. The Split DNS feature supports the use of a standard ACL as a view-use restriction based on the query source IP address. In order for a source IP address to match a name list, the IP address must match a rule that explicitly permits a matching pattern but the IP address cannot match any rules that explicitly deny a matching pattern.

Interface-specific View Lists

A DNS view list can be attached to a router interface. When an incoming DNS query arrives on that interface, the Cisco IOS software uses that view list to select a DNS view to use to handle the query.

Default DNS View List

A DNS view list can be configured as the default DNS view list for the router. When an incoming DNS query arrives on an interface that is not configured to use a specific view list, the Cisco IOS software uses the default view list to select the DNS view to use to handle the query.

Enabling a Split DNS debug command enables output to be written at every occurrence of a DNS name list event, a DNS view event, or a DNS view list event. The router continues to generate such output until you enter the corresponding no debug command. You can use the output from the Split DNS debug commands to diagnose and resolve internetworking problems associated with Split DNS operations.

Note

By default, the network server sends the output from the debug commands to the console. Sending output to a terminal (virtual console) produces less overhead than sending it to the console. Use the terminal monitor privileged EXEC command to send output to a terminal. For more information about redirecting debug command output, see the “Using Debug Commands” chapter of the Cisco IOS Debug Command Reference .

A DNS name list event can be of any of the following:

• The addition or removal of a DNS name list entry (a hostname pattern and action to perform on an incoming DNS query for a hostname that matches the pattern).
• The removal of a DNS name list.

A DNS view event can be any of the following:

• The addition or removal of a DNS view definition.
• The addition or removal of a DNS forwarding name server setting for a DNS view.
• The addition or removal of a DNS resolver setting for a DNS view.
• The enabling or disabling of logging of a syslog message each time a DNS view is used.

A DNS view list event can be any of the following:

• The addition or removal of a DNS view list definition.
• The addition or removal of a DNS view list member (a DNS view and the relative order in which it is to be checked in the view list) to or from a DNS view list.
• The setting or clearing of a DNS view list assignment as the default view list for the router or to a specific interface on the router.

Perform this optional task if you want to enable the writing of an event message to syslog output for DNS name list events, view events, or view list events:

Perform this optional task if you need to define a DNS name list. A DNS name list is a list of hostname pattern-matching rules that could be used as an optional usage restriction on a DNS view list member.

Perform this task to define a DNS view. A DNS view definition can be used to respond to either an incoming DNS query or an internally generated DNS query.

It is easier to refer to network devices by symbolic names rather than numerical addresses (services such as Telnet can use hostnames or addresses). Hostnames and IP addresses can be associated with one another through static or dynamic means. Manually assigning hostnames-to-address mappings is useful when dynamic mapping is not available.

Perform this optional task if you need to define static entries in the DNS hostname cache for a DNS view.

Perform this task to define an ordered list of DNS views with optional, additional usage restrictions for each view list member. The router uses a DNS view list to select the DNS view that will be used to handle a DNS query.

Perform this task to specify the default DNS view list for the router’s DNS server. The router uses the default DNS view list to select a DNS view to use to handle an incoming DNS query that arrives on an interface for which no interface-specific DNS view list has been defined.

Perform this optional task if you need to specify a DNS view list for a particular router interface. The router uses that view list to select a DNS view to use to handle a DNS query that arrives on that interface.

Perform this optional task if you need to specify a source interface to forward the DNS queries.

The following example shows how to define two different VRFs and then define two different DNS views that are associated with those VRFs:

ip vrf vpn101 
 description VRF vpn101 for example purposes
 rd 10:112
 exit
!
ip vrf vpn102 
 description VRF vpn102 for example purposes
 rd 10:128
 exit
!
ip dns view vrf vpn101 
 .
 .
 .
exit
!
ip dns view vrf vpn102 user1
 .
 .
 .
exit

The two DNS views are both named user1, but each view is associated with a different VRF.

• The default DNS view associated with VRF vpn101 is limited to handling DNS queries from VRF vpn101 only. This view will be used by the resolver for commands which specify a VRF, such as ping vrf vpn101 www.example.com.
• The DNS view user1 associated with VRF vpn102 is limited to handling DNS queries from VRF vpn102 only. This view will only be used if specified inside a DNS view list that is configured for use by the DNS server globally or for a specific interface.

The two DNS views in this example can be configured with the same DNS resolving and forwarding parameters, or they can be configured with different DNS resolving and forwarding parameters.

The following example shows how to populate the list of resolving name servers for the default DNS view in the global namespace with three statically defined IP addresses. The example also shows how to configure the router to be able to dynamically acquire, through DHCP or PPP interaction on FastEthernet slot 0, port 1, name server IP addresses to add to the list of resolving name servers for that view:

ip dns view default 
 domain lookup
 domain name-server 192.168.2.204
 domain name-server 192.168.2.205
 domain name-server 192.168.2.206
 domain name-server interface FastEthernet0/0

The following example shows how to statically add three hostname-to-address mappings for the host www.example.com in the DNS hostname cache for the DNS view user5 that is associated with VRF vpn101:

clear host all * 
 ip host vrf vpn101 view user5 www.example.com 192.168.2.10 192.168.2.20 192.168.2.30 
 exit
show hosts vrf vpn101 view user5

Note	It does not matter whether the VRF vpn101 has been defined. The hostname cache for this DNS view will be automatically created, and the hostname will be added to the cache.

When resolving DNS queries using a DNS view for which the hostname cache contains hostnames that are associated with multiple IP addresses, the router sends those queries to the first associated IP address in the hostname cache. By default, the other associated addresses in the hostname cache are used only in the event of host failure.

The round-robin rotation of hostname cache entries specifies that each time a hostname in the internal cache is accessed, the list of IP addresses associated with that hostname should be rotated such that the second IP address in the list becomes the first one and the first one is moved to the end of the list. For a more detailed description of round-robin functionality, see the description of the ip domain round-robin command in the Cisco IOS IP Addressing Services Command Reference .

The following example shows how to define the hostname www.example.com with three IP addresses and then enable round-robin rotation for the default DNS view associated with the global VRF. Each time that hostname is referenced internally or queried by a DNS client sending a query to the Cisco IOS DNS server on this system, the order of the IP addresses associated with the host www.example.com will be changed. Because most client applications look only at the first IP address associated with a hostname, this results in different clients using each of the different addresses and thus distributing the load among the three different IP addresses.

ip host view www.example.com 192.168.2.10 192.168.2.20 192.168.2.30 
! 
ip dns view default 
 domain lookup 
 domain round-robin

The following example shows how to configure one DNS name list and one standard IP ACL:

• A DNS name list is a list of hostname pattern-matching rules that can be used to restrict the use of a DNS view list member.
• A standard IP ACL is a list of IP addresses that can be used to restrict the use of a DNS view list member.

Both types of lists can be used to limit the types of DNS queries that a DNS view is allowed to handle.

! Define a DNS name-list
!
ip dns name-list 151 deny .*.example1.net 
! (Note: The view fails this list if the query hostname matches this)
!
ip dns name-list 151 permit .*.example1.com 
ip dns name-list 151 permit www.example1.org 
! (Note: All other access implicitly denied)
!
! Define a standard IP ACL
!
access-list 71 deny 192.168.2.64 0.0.0.63 
! (Note: The view fails this list if the query source IP matches this)
!
access-list 71 permit 192.168.2.128 0.0.0.63 
! (Note: All other access implicitly denied)

Using this configuration example, suppose that the first member of a DNS view list is configured to use DNS name list 151 as a usage restriction. Then, if the router were to use that DNS view list to select the DNS view to use to handle a given DNS query, the view-selection steps would begin as follows:

1. If the DNS query is for a hostname that matches the string *.example1.net, the first DNS view list member is immediately rejected and the view-selection process moves on to the second member of DNS view list.
2. If the DNS query is for a hostname that matches the string *.example1.com, the first DNS view list member is selected to handle the query.
3. If the DNS query is for a hostname that matches the string www.example1.org, the first DNS view list member is selected to handle the query. Otherwise, the first DNS view list member is rejected and the view-selection process moves on to the second member of DNS view list.

Continuing to use this configuration example, suppose that this same DNS view list member is also configured to use standard IP ACL 71 as a usage restriction. Then, even if the query hostname matched DNS name list 151, the query source IP address would have to match standard IP ACL 71 before that view would be selected to handle the query. To validate this second usage restriction, the DNS view-selection steps would continue as follows:

1. If the DNS query source IP address matches 192.168.2.64, the first DNS view list member is selected to handle the query.
2. If the DNS query source IP address matches 192.168.2.128, the first DNS view list member is selected to handle the query. Otherwise, the first DNS view list member is rejected and the view-selection process moves on to the second member of the DNS view list.

The following example shows how to define two DNS view lists, userlist1 and userlist2. Both view lists comprise the same three DNS views:

• DNS view user1 that is associated with the usergroup10 VRF
• DNS view user2 that is associated with the usergroup20 VRF
• DNS view user3 that is associated with the usergroup30 VRF

Both view lists contain the same DNS views, specified in the same order:

ip dns view-list userlist15 
 view vrf usergroup100 user1 10 
  restrict name-group 121 
  exit
view vrf usergroup200 user2 20 
  restrict name-group 122 
  exit
view vrf usergroup300 user3 30 
  restrict name-group 123 
  exit
!
exit
ip dns view-list userlist16 
 view vrf usergroup100 user1 10 
  restrict name-group 121 
  restrict source access-group 71 
  exit
 view vrf usergroup200 user2 20 
  restrict name-group 122 
  restrict source access-group 72 
  exit
 view vrf usergroup300 user3 30 
  restrict name-group 123 
  restrict source access-group 73 
  exit
exit

The two DNS view lists differ, though, in the usage restrictions placed on their respective view list members. DNS view list userlist15 places only query hostname restrictions on its members while view list userlist16 restricts each of its members on the basis of the query hostname and the query source IP address:

• Because the members of userlist15 are restricted only based on the VRF from which the query originates, userlist15 is typical of a view list that can be used to select a DNS view for handling DNS requests from internal clients.
• Because the members of userlist16 are restricted not only by the query VRF and query hostname but also by the query source IP address, userlist16 is typical of a view list that can be used to select a DNS view for handling DNS requests from external clients.

The following example shows how to configure the default DNS view list and two interface-specific view lists:

ip dns server view-group userlist1 
! 
interface FastEthernet 0/0 
 ip dns view-group userlist2
 exit
! 
interface FastEthernet 0/1
 ip dns view-group userlist3 
 exit

The Cisco IOS software uses the DNS view list named userlist1 to select the DNS view to use to respond to incoming queries that arrive on router interfaces that are not configured to use a specific view list. View list userlist1 is configured as the default DNS view list for the router.

The Cisco IOS software uses the DNS view list named userlist2 to select the DNS view to use for incoming queries that arrive on port 0 of the FastEthernet card in slot 0.

The Cisco IOS software uses the DNS view list named userlist3 to select the DNS view to use for incoming queries that arrive on port 1 of the FastEthernet card in slot 0.