SWA_CLI> dnsconfig
Currently using the local DNS cache servers:
1. Priority: 0 10.1.1.1
2. Priority: 1 10.2.2.2
3. Priority: 2 10.3.3.3
Currently using the following Secondary DNS cache servers :
1. Priority: 0 10.10.10.10
Choose the operation you want to perform:
- NEW - Add a new server.
- EDIT - Edit a server.
- DELETE - Remove a server.
- SETUP - Configure general settings.
- SEARCH - Configure DNS domain search list.
[]>
第二步：要将新的DNS服务器添加到列表，请键入NEW并按Enter。
第三步：选择主要DNS名称服务器或辅助DNS名称服务器，以便向其中添加新名称服务器。
[]> NEW
Do you want to make changes in the Primary DNS nameserver list or secondary DNS nameserver list?
1. Make changes to the primary DNS nameserver
2. Make changes to the secondary DNS nameserver
[]> 1
第四步：选择添加新的域名服务器或备用域服务器（条件转发域名）
Do you want to add a new local DNS cache server or an alternate domain server?
1. Add a new local DNS cache server.
2. Add a new alternate domain server.
[]> 1
第五步： 提供新域名服务器的IP地址
第六步：为新添加的名称服务器提供优先级。
Please enter the IP address of your DNS server.
Separate multiple IPs with commas.
[]> 10.4.4.4
Please enter the priority for 10.4.4.4.
A value of 0 has the highest priority.
The IP will be chosen at random if they have the same priority.
[0]> 4
Currently using the local DNS cache servers:
1. Priority: 0 10.1.1.1
2. Priority: 1 10.2.2.2
3. Priority: 2 10.3.3.3
4. Priority: 4 10.4.4.4
Currently using the following Secondary DNS cache servers :
1. Priority: 0 10.10.10.10
步骤 7.按Enter退出向导。
步骤 8键入commit保存更改。
注意：要编辑或删除任何名称服务器，可以从dnsconfig中选择EDIT和DELETE。
从SETUP选项可以配置DNS缓存时间和脱机DNS检测设置：
SWA_CLI> dnsconfig
....
[]> setup
Do you want the Gateway to use the Internet's root DNS servers or would you like it to use your own DNS servers?
1. Use Internet root DNS servers
2. Use own DNS cache servers
[2]> 2
Enter the number of seconds to wait before timing out reverse DNS lookups.
[20]>
Enter the minimum TTL in seconds for DNS cache.
[1800]>
Do you want to enable Secure DNS? [N]> N
Warning: Ensure that you configure the DNS server with DNSSec because there is no backward compatibility.
Failing to do so can result in invalid response with an unresolved hostname.
You must use FQDN with the hostname for the local and private domains.
Enter the number of failed attempts before considering a local DNS server offline.
[100]>
Enter the interval in seconds for polling an offline local DNS server.
[5]>
dnsconfig
Currently using the local DNS cache servers:
1. Priority: 0 10.1.1.1
2. Priority: 0 10.2.2.2
Choose the operation you want to perform:
- NEW - Add a new server.
- EDIT - Edit a server.
- DELETE - Remove a server.
- SETUP - Configure general settings.
- SEARCH - Configure DNS domain search list.
[]> localhosts
Local IP to Host mappings:
Choose the operation you want to perform:
- NEW - Add new local IP to host mapping.
- DELETE - Delete an existing mapping.
[]> new
Enter the IP address of the host you are adding.
[]> 10.20.30.40
Enter the canonical host name and any additional aliases (separate values
with spaces)
[]> ManualHostEntry.cisco.com
dnsflush
dnsflush从DNS缓存表中删除所有缓存的DNS记录：
SWA_CLI> dnsflush
Are you sure you want to clear out the DNS cache? [N]> Y
advancedproxyconfig
advancedproxyconfig
Choose a parameter group:
- AUTHENTICATION - Authentication related parameters
- CACHING - Proxy Caching related parameters
- DNS - DNS related parameters
- EUN - EUN related parameters
- NATIVEFTP - Native FTP related parameters
- FTPOVERHTTP - FTP Over HTTP related parameters
- HTTPS - HTTPS related parameters
- SCANNING - Scanning related parameters
- PROXYCONN - Proxy connection header related parameters
- CUSTOMHEADERS - Manage custom request headers for specific domains
- MISCELLANEOUS - Miscellaneous proxy related parameters
- SOCKS - SOCKS Proxy parameters
- CONTENT-ENCODING - Block content-encoding types
- SCANNERS - Scanner related parameters
[]> DNS
Enter values for the DNS options:
Enter the URL format for the HTTP 307 redirection on DNS lookup failure.
[%P://www.%H.com/%u]>
Would you like the proxy to issue a HTTP 307 redirection on DNS lookup failure?
[Y]>
Would you like proxy not to automatically failover to DNS results when upstream
proxy (peer) is unresponsive?
[N]>
Select one of the following options:
0 = Always use DNS answers in order
1 = Use client-supplied address then DNS
2 = Limited DNS usage
3 = Very limited DNS usage
For options 1 and 2, DNS will be used if Web Reputation is enabled.
For options 2 and 3, DNS will be used for explicit proxy requests, if there is
no upstream proxy or in the event the configured upstream proxy fails.
For all options, DNS will be used when Destination IP Addresses are used in
policy membership.
Find web server by:
[0]>
SWA_CLI> logconfig
Currently configured logs:
...
42. "system_logs" Type: "System Logs" Retrieval: FTP Poll
...
Choose the operation you want to perform:
- NEW - Create a new log.
- EDIT - Modify a log subscription.
- DELETE - Remove a log subscription.
- HOSTKEYCONFIG - Configure SSH host keys.
- AUDITLOGCONFIG - Adjust settings for audit logging.
[]> EDIT
Enter the number of the log you wish to edit:
[]> 42 <--- in this example the System_logs is number 42
Please enter the name for the log:
[system_logs]>
Log level:
1. Critical
2. Warning
3. Information
4. Debug
5. Trace
[3]> 4
....
SWA_CLI> commit
SWA_CLI> nslookup
Please enter the host or IP address to resolve.
[]> cisco.com
Choose the query type:
1. A the host's IP address
2. AAAA the host's IPv6 address
3. CNAME the canonical name for an alias
4. MX the mail exchanger
5. NS the name server for the named zone
6. PTR the hostname if the query is an Internet address,
otherwise the pointer to other information
7. SOA the domain's "start-of-authority" information
8. TXT the text information
[1]> 1
A=10.20.3.15 TTL=30m
TSWA_CLI> nslookup
Please enter the host or IP address to resolve.
[]> cisco.com
Choose the query type:
1. A the host's IP address
2. AAAA the host's IPv6 address
3. CNAME the canonical name for an alias
4. MX the mail exchanger
5. NS the name server for the named zone
6. PTR the hostname if the query is an Internet address,
otherwise the pointer to other information
7. SOA the domain's "start-of-authority" information
8. TXT the text information
[1]> 1
A=10.20.3.15 TTL=28m 49s
dig
dig是查询DNS记录的另一个有用命令。使用dig，您可以指定要查询的源接口或DNS服务器：
在本示例中，查询来自服务器10.1.1.1的A记录
dig @10.1.1.1 www.cisco.com A
; <<>> DiG 9.16.8 <<>> @10.1.1.1 www.cisco.com A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58012
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
; COOKIE: 2cbc212c0877096701000000623db99b050bda7f896790e3 (good)
;; QUESTION SECTION:
;www.cisco.com. IN A
;; ANSWER SECTION:
www.cisco.com. 3600 IN CNAME origin-www.cisco.com.
www.cisco.com. 5 IN A 10.20.3.15
;; Query time: 115 msec
;; SERVER: 10.1.1.1#53(10.1.1.1)
;; WHEN: Fri Mar 25 12:46:19 GMT 2022
;; MSG SIZE rcvd: 111
dig的使用：
dig [-s ] [-t] [-x
] [@
] hostname [qtype] Query a DNS server. @
- Query the DNS server at this IP address hostname - Record that you want to look up. qtype - Query type: A, PTR, CNAME, MX, SOA, NS, TXT options: -s IP Address Specify the source IP address. -t Make query over tcp. -x IP Address Do a reverse lookup on this IP address.
...
INFO: DNS Cache Stats: Entries 662, Expire 1697, Hits 88739, Misses 664, Reclaims 0
...
DNS Time 1.0 ms 349
DNS Time 1.6 ms 550
DNS Time 2.5 ms 374
DNS Time 4.0 ms 32
DNS Time 6.3 ms 35
DNS Time 10.0 ms 37
DNS Time 15.8 ms 301
DNS Time 25.1 ms 80
DNS Time 39.8 ms 136
DNS Time 63.1 ms 91
DNS Time 100.0 ms 12
DNS Time 158.5 ms 33
DNS Time 251.2 ms 14
DNS Time 398.1 ms 12
DNS Time 631.0 ms 45
DNS Time 1000.0 ms 120
DNS Time 1584.9 ms 73
DNS Time 2511.9 ms 296
DNS Time 3981.1 ms 265
DNS Time 6309.6 ms 190
Image-GUI — 配置DNS设置
映像 — DNS配置
映像 — 更改系统日志，日志级别
映像 — 添加过滤器以捕获DNS数据包
映像 — DNS失败错误
反馈