Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1204 / 2086

45-10
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 45 Configuring AVC with DNS-AS
Configuring AVC with DNS-AS
Making an Entry in the Trusted Domain List
When AVC with DNS-AS is first enabled on the switch, the trusted domain list is empty. You must
maintain the list of trusted domains on the switch. The switch snoops only for network traffic that is
maintained in this list. To make entries in this list, perform the following task
Command or Action Purpose
Step 1
configure terminal
Example:
Switch# configure terminal
Enters global configuration mode.
Step 2 [no] avc dns-as client enable
Example:
Switch(config)# avc dns-as client enable
Enables AVC with DNS-AS on the switch (DNS-AS client).
The system then creates a binding table where parsed DNS server
responses are stored till the TTL expires.
Note To ensure DNS packet logging or snooping, you must
attach the policy map (containing the relevant class maps
that will determine traffic class) to the interface by using
the
service-policy input command. For more information
see Configuring QoS for AVC with DNS-AS, page 45-11 .
Command or Action Purpose
Step 1 configure terminal
Example:
Switch#
configure terminal
Enters global configuration mode.
Step 2 [ no ] avc dns-as client trusted-domains
Example:
Switch(config)#
avc dns-as client
trusted-domains
Enters the trusted domain configuration mode.
Step 3 [ no ] domain domain-name
Example:
Switch(config-trusted-domains)# domain
www.example.com
Enter the domain name. This forms part of the list of trusted
domains for the DNS-AS client. All remaining domains are
ignored and will follow default forwarding behavior.
You can enter up to 50 domains.
You can use regular expressions to match the domain name. For
example, to represent all the domains for an organization, if you
enter:
Switch(config-trusted-domains)# domain *.example.*
The DNS-AS client matches www.example.com, ftp.example.org
and any other domain that pertains to the organization “example”.
But use such an entry at your discretion, because it could increase
the size of the binding table considerably.