Cisco Catalyst 4500 Series, Руководство по настройке программного обеспечения

Страница: 1198 / 2086

45-4
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 45 Configuring AVC with DNS-AS
About AVC with DNS-AS
AVC with DNS-AS Process Flow
This involves the DNS snooping process and the DNS-AS client process—both of which are loosely
coupled, but independent processes.
Figure 45-1 is a representation of both processes.
Part -I: DNS Snooping Process
Step 1
The host initiates an “A” record request.
A user from your organization is in a meeting room in an office building. The associated
DNS-AS client here is a switch (the wired network traffic from this meeting room is routed
through this switch). The user looks up a website www.example.com, which initiates the request
for an “A” record.
Step 2
The authoritative DNS-server responds with an “A” record response.
Part-II: DNS-AS Client Process
Step 1
The DNS-AS client sends a DNS query (TXT request) to the authoritative DNS server.
The DNS-AS client, which is constantly snooping for requests (based on the trusted domain
list), finds the host’s forward look-up request.
Note
The DNS-AS client receives a copy of the host’s “A” record request, and does not alter
the host’s original request in any manner.
Based on the snooped result, the DNS-AS client sends a TXT request to the authoritative DNS
server.
Step 2
The authoritative DNS-server responds with a TXT record response.
Step 3
A successful TXT response is followed by an “A” record request.
Step 4
The authoritative DNS-server responds with an “A” record response.
Step 5 The DNS-AS client parses and saves the response in its binding table.
The DNS-AS client saves the TXT record and “A” record in its binding table. The response will
remain saved in the binding table for the duration specified by the TTL of the “A” record. The
system automatically checks and prevents duplicate entries for a fully qualified domain name
in the binding table.
The DNS-AS client applies a QoS policy based on the metadata from the DNS server, and
exports application information to a collector, based on how the flow record is configured.
The DNS-AS client forwards information about identified applications to FNF, enabling you to
export this information.