THIS DOCUMENTATION HAS BEEN MOVED
VRF Aware DNS
Download this chapter
VRF Aware DNSVRF Aware DNS
 Feedback

Table Of Contents

VRF-Aware DNS

Finding Feature Information

Contents

Information About VRF-Aware DNS

Domain Name System

VRF Mapping and VRF-Aware DNS

How to Configure VRF-Aware DNS

Defining a VRF Table and Assigning a Name Server to Enable VRF-Aware DNS

Mapping VRF-Specific Hostnames to IP Addresses

Configuring a Static Entry in a VRF-Specific Name Cache

Verifying the Name Cache Entries in the VRF Table

Configuration Examples for VRF-Aware DNS

VRF-Specific Name Server Configuration: Example

VRF-Specific Domain Name List Configuration: Example

VRF-Specific Domain Name Configuration: Example

VRF-Specific IP Host Configuration: Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Feature Information for VRF-Aware DNS


VRF-Aware DNS

First Published: October 30, 2006
Last Updated: May 4, 2009

The VRF-Aware DNS feature enables the configuration of a Virtual Private Network (VPN) routing and forwarding instance (VRF) table so that the domain name system (DNS) can forward queries to name servers using the VRF table rather than the named DNS server in the global IP address space. This feature allows DNS requests to be resolved within the appropriate Multiprotocol Label Switching (MPLS) VPN.

Finding Feature Information

For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for VRF-Aware DNS" section.

Use Cisco Feature Navigator to find information about platform support and Cisco IOS XE and Cisco IOS XE software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Contents

•Information About VRF-Aware DNS

•How to Configure VRF-Aware DNS

•Configuration Examples for VRF-Aware DNS

•Additional References

•Feature Information for VRF-Aware DNS

Information About VRF-Aware DNS

To configure the VRF-Aware DNS feature, you should understand the following concepts:

•Domain Name System

•VRF Mapping and VRF-Aware DNS

Domain Name System

Domain Name System (DNS) is a standard that defines a domain naming procedure used in TCP/IP. A domain is a hierarchical separation of the network into groups and subgroups with domain names identifying the structure. The named groups consist of named objects, usually devices like IP hosts, and the subgroups are domains. DNS has three basic functions:

•Name space: This function is a hierarchical space organized from a single root into domains. Each domain can contain device names or more specific information. A special syntax defines valid names and identifies the domain names.

•Name registration: This function is used to enter names into the DNS database. Policies are outlined to resolve conflicts and other issues.

•Name resolution: This function is a distributed client and server name resolution standard. The name servers are software applications that run on a server and contain the resource records (RRs) that describe the names and addresses of those entities in the DNS name space. A name resolver is the interface between the client and the server. The name resolver requests information from the server about a name. A cache can be used by the name resolver to store learned names and addresses.

A DNS server can be a dedicated device or a software process running on a device. The server stores and manages data about domains and responds to requests for name conflict resolutions. In a large DNS implementation, there can be a distributed database over many devices. A server can be a dedicated cache.

VRF Mapping and VRF-Aware DNS

To keep track of domain names, IP has defined the concept of a name server, whose job is to hold a cache (or database) of names appended to IP addresses. The cached information is important because the requesting DNS will not need to query for that information again, which is why DNS works well. If a server had to query each time for the same address because it had not saved any data, the queried servers would be flooded and would crash.

A gateway for multiple enterprise customers can be secured by mapping the remote users to a VRF domain. Mapping means obtaining the IP address of the VRF domain for the remote users. By using VRF domain mapping, a remote user can be authenticated by a VRF domain-specific AAA server so that the remote-access traffic can be forwarded within the VRF domain to the servers on the corporate network.

To support traffic for multiple VRF domains, the DNS and the servers used to resolve conflicts must be VRF aware. VRF aware means that a DNS subsystem will query the VRF name cache first, then the VRF domain, and store the returned RRs in a specific VRF name cache. Users are able to configure separate DNS name servers per VRF.

VRF-aware DNS forwards queries to name servers using the VRF table. Because the same IP address can be associated with different DNS servers in different VRF domains, a separate list of name caches for each VRF is maintained. The DNS looks up the specific VRF name cache first, if a table has been specified, before sending a query to the VRF name server. All IP addresses obtained from a VRF-specific name cache are routed using the VRF table.

How to Configure VRF-Aware DNS

This section contains the following tasks:

•Defining a VRF Table and Assigning a Name Server to Enable VRF-Aware DNS

•Mapping VRF-Specific Hostnames to IP Addresses

•Configuring a Static Entry in a VRF-Specific Name Cache

•Verifying the Name Cache Entries in the VRF Table

Defining a VRF Table and Assigning a Name Server to Enable VRF-Aware DNS

Perform this task to define a VRF table and assign a name server.

A VRF-specific name cache is dynamically created if one does not exist whenever a VRF-specific name server is configured by using the ip name-server vrf command option or a permanent name entry is configured by using the ip host vrf command option. The VRF name cache is removed whenever all name server and permanent entries in the VRF are disabled.

It is possible that multiple name servers are configured with the same VRF name. The system will send queries to those servers in turn until any of them responds, starting with the server that sent a response the last time.

SUMMARY STEPS

1. enable

2. configure terminal

3. ip vrf vrf-name

4. rd route-distinguisher

5. exit

6. ip name-server [vrf vrf-name] server-address1 [server-address2...server-address6]

7. ip domain lookup

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3 

ip vrf vrf-name

Example:

Router(config)# ip vrf vpn1

Defines a VRF table and enters VRF configuration mode.

•The vrf-name argument can be up to 32 characters.

Step 4 

rd route-distinguisher

Example:

Router(config-vrf)# rd 100:21

Creates routing and forwarding tables for a VRF.

Step 5 

exit

Example:

Router(config-vrf)# exit

Exits VRF configuration mode.

Step 6 

ip name-server [vrf vrf-name] server-address1 [server-address2...server-address6]

Example:

Router(config)# ip name-server vrf vpn1 172.16.1.111 172.16.1.2

Assigns the address of one or more name servers to a VRF table to use for name and address resolution.

•The vrf keyword is optional but must be specified if the name server is used with VRF. The vrf-name argument assigns a name to the VRF.

Step 7 

ip domain lookup

Example:

Router(config)# ip domain lookup

(Optional) Enables DNS-based address translation.

•DNS is enabled by default. You only need to use this command if DNS has been disabled.

Mapping VRF-Specific Hostnames to IP Addresses

Perform this task to map VRF-specific hostnames to IP addresses.

SUMMARY STEPS

1. enable

2. configure terminal

3. ip domain name [vrf vrf-name] name
or
ip domain list [vrf vrf-name] name

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3 

ip domain name [vrf vrf-name] name

or

ip domain list [vrf vrf-name] name

Example:

Router(config)# ip domain name vrf vpn1 cisco.com

or

Example:

Router(config)# ip domain list vrf vpn1 cisco.com

Defines a default domain name that the Cisco IOS XE software will use to complete unqualified hostnames.

or

Defines a list of default domain names to complete unqualified hostnames.

•You can specify a default domain name that the Cisco IOS XE software will use to complete domain name requests. You can specify either a single domain name or a list of domain names. Any hostname that does not contain a complete domain name will have the default domain name you specify appended to it before the name is looked up.

•The vrf keyword and vrf-name argument specify a default VRF domain name.

•The ip domain list command can be entered multiple times to specify more than one domain name to append when doing a DNS query. The system will append each in turn until it finds a match.

Configuring a Static Entry in a VRF-Specific Name Cache

Perform this task to configure a static entry in a VRF-specific name cache.

A VRF-specific name cache is dynamically created if one does not exist whenever a name server is configured for the VRF by using the ip name-server vrf command option or a permanent name entry is configured by using the ip host vrf command option. The VRF name cache is removed whenever all name server and permanent entries in the VRF are disabled.

SUMMARY STEPS

1. enable

2. configure terminal

3. ip host [vrf vrf-name] name [tcp-port-number] address1 [address2...address8]

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3 

ip host [vrf vrf-name] name [tcp-port] address1 [address2...address8]


Example:

Router(config)# ip host vrf vpn3 company1.com 172.16.2.1

Defines a static hostname-to-address mapping in the host cache.

•If the vrf keyword and vrf-name arguments are specified, then a permanent entry is created only in the VRF-specific name cache.

Verifying the Name Cache Entries in the VRF Table

Perform this task to verify the name cache entries in the VRF table.

SUMMARY STEPS

1. enable

2. show hosts [vrf vrf-name] {all | hostname} [summary]

3. clear host [vrf vrf-name] {all | hostname}

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

show hosts [vrf vrf-name] {all | hostname} [summary]

Example:

Router# show hosts vrf vpn2

•Displays the default domain name, the style of name lookup service, a list of name server hosts, the cached list of hostnames and addresses, and the cached list of hostnames and addresses specific to a particular Virtual Private Network (VPN).

•The vrf keyword and vrf-name argument only display the entries if a VRF name has been configured.

•If you enter the show hosts command without specifying any VRF, only the entries in the global name cache will display.

Step 3 

clear host [vrf vrf-name] {all | hostname}

Example:

Router# clear host vrf vpn2

(Optional) Deletes entries from the hostname-to-address global address cache or VRF name cache.

Configuration Examples for VRF-Aware DNS

This section provides the following configuration examples:

•VRF-Specific Name Server Configuration: Example

•VRF-Specific Domain Name List Configuration: Example

•VRF-Specific Domain Name Configuration: Example

•VRF-Specific IP Host Configuration: Example

VRF-Specific Name Server Configuration: Example

The following example shows how to specify a VPN named vpn1 with the IP addresses of 172.16.1.111 and 172.16.1.2 as the name servers: 

ip name-server vrf vpn1 172.16.1.111 172.16.1.2

VRF-Specific Domain Name List Configuration: Example

The following example shows how to add several domain names to a list in vpn1 and vpn2. The domain name is only used for name queries in the specified VRF. 

ip domain list vrf vpn1 company.com

ip domain list vrf vpn2 school.edu

If there is no domain list, the domain name that you specified with the ip domain name global configuration command is used. If there is a domain list, the default domain name is not used. The ip domain list command is similar to the ip domain name command, except that with the ip domain list command you can define a list of domains, each to be tried in turn until a match is found.

VRF-Specific Domain Name Configuration: Example

The following example shows how to define cisco.com as the default domain name for a VPN named vpn1. The domain name is only used for name queries in the specified VRF. 

ip domain name vrf vpn1 cisco.com

Any IP hostname that does not contain a domain name (that is, any name without a dot) will have the dot and cisco.com appended to it before being looked up.

VRF-Specific IP Host Configuration: Example

The following example shows how to define two static hostname-to-address mappings in the host cache for vpn2 and vpn3: 

ip host vrf vpn2 host2 10.168.7.18

ip host vrf vpn3 host3 10.12.0.2

Additional References

The following sections provide references related to the VRF-Aware DNS feature.

Related Documents

Related Topic
Document Title

DNS configuration tasks

Configuring DNS module

IP addressing services commands: complete command syntax, command mode, command history, defaults, usage guidelines, and examples

Cisco IOS IP Addressing Services Command Reference


Standards

Standards
Title

No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

—


MIBs

MIBs
MIBs Link

No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

To locate and download MIBs for selected platforms, Cisco IOS XE releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs


RFCs

RFCs
Title

No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.

—


Technical Assistance

Description
Link

The Cisco Technical Support website contains thousands of pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content.

http://www.cisco.com/techsupport


Feature Information for VRF-Aware DNS

Table 1 lists the features in this module and provides links to specific configuration information.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS XE software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Note Table 1 lists only the Cisco IOS XE software release that introduced support for a given feature in a given Cisco IOS XE software release train. Unless noted otherwise, subsequent releases of that Cisco IOS XE software release train also support that feature.

Table 1 Feature Information for DNS

Feature Name
Releases
Feature Configuration Information

VRF-Aware DNS

Cisco IOS XE
Release 2.1

The VRF-Aware DNS feature enables the configuration of a Virtual Private Network (VPN) routing and forwarding instance (VRF) table so that the domain name system (DNS) can forward queries to name servers using the VRF table rather than the named DNS server in the global IP address space. This feature allows DNS requests to be resolved within the appropriate Multiprotocol Label Switching (MPLS) VPN.


CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0910R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2007-2009 Cisco Systems, Inc. All rights reserved.