SWA_CLI> dnsconfig
Currently using the local DNS cache servers:
1. Priority: 0 10.1.1.1
2. Priority: 1 10.2.2.2
3. Priority: 2 10.3.3.3
Currently using the following Secondary DNS cache servers :
1. Priority: 0 10.10.10.10
Choose the operation you want to perform:
- NEW - Add a new server.
- EDIT - Edit a server.
- DELETE - Remove a server.
- SETUP - Configure general settings.
- SEARCH - Configure DNS domain search list.
[]>
[]> NEW
Do you want to make changes in the Primary DNS nameserver list or secondary DNS nameserver list?
1. Make changes to the primary DNS nameserver
2. Make changes to the secondary DNS nameserver
[]> 1
Do you want to add a new local DNS cache server or an alternate domain server?
1. Add a new local DNS cache server.
2. Add a new alternate domain server.
[]> 1
ステップ 5： 新しいネームサーバのIPアドレスを入力します。
手順 6：新しく追加したネームサーバのプライオリティを入力します。
Please enter the IP address of your DNS server.
Separate multiple IPs with commas.
[]> 10.4.4.4
Please enter the priority for 10.4.4.4.
A value of 0 has the highest priority.
The IP will be chosen at random if they have the same priority.
[0]> 4
Currently using the local DNS cache servers:
1. Priority: 0 10.1.1.1
2. Priority: 1 10.2.2.2
3. Priority: 2 10.3.3.3
4. Priority: 4 10.4.4.4
Currently using the following Secondary DNS cache servers :
1. Priority: 0 10.10.10.10
SWA_CLI> dnsconfig
....
[]> setup
Do you want the Gateway to use the Internet's root DNS servers or would you like it to use your own DNS servers?
1. Use Internet root DNS servers
2. Use own DNS cache servers
[2]> 2
Enter the number of seconds to wait before timing out reverse DNS lookups.
[20]>
Enter the minimum TTL in seconds for DNS cache.
[1800]>
Do you want to enable Secure DNS? [N]> N
Warning: Ensure that you configure the DNS server with DNSSec because there is no backward compatibility.
Failing to do so can result in invalid response with an unresolved hostname.
You must use FQDN with the hostname for the local and private domains.
Enter the number of failed attempts before considering a local DNS server offline.
[100]>
Enter the interval in seconds for polling an offline local DNS server.
[5]>
dnsconfig
Currently using the local DNS cache servers:
1. Priority: 0 10.1.1.1
2. Priority: 0 10.2.2.2
Choose the operation you want to perform:
- NEW - Add a new server.
- EDIT - Edit a server.
- DELETE - Remove a server.
- SETUP - Configure general settings.
- SEARCH - Configure DNS domain search list.
[]> localhosts
Local IP to Host mappings:
Choose the operation you want to perform:
- NEW - Add new local IP to host mapping.
- DELETE - Delete an existing mapping.
[]> new
Enter the IP address of the host you are adding.
[]> 10.20.30.40
Enter the canonical host name and any additional aliases (separate values
with spaces)
[]> ManualHostEntry.cisco.com
SWA_CLI> dnsflush
Are you sure you want to clear out the DNS cache? [N]> Y
advancedproxyconfig
advancedproxyconfig
Choose a parameter group:
- AUTHENTICATION - Authentication related parameters
- CACHING - Proxy Caching related parameters
- DNS - DNS related parameters
- EUN - EUN related parameters
- NATIVEFTP - Native FTP related parameters
- FTPOVERHTTP - FTP Over HTTP related parameters
- HTTPS - HTTPS related parameters
- SCANNING - Scanning related parameters
- PROXYCONN - Proxy connection header related parameters
- CUSTOMHEADERS - Manage custom request headers for specific domains
- MISCELLANEOUS - Miscellaneous proxy related parameters
- SOCKS - SOCKS Proxy parameters
- CONTENT-ENCODING - Block content-encoding types
- SCANNERS - Scanner related parameters
[]> DNS
Enter values for the DNS options:
Enter the URL format for the HTTP 307 redirection on DNS lookup failure.
[%P://www.%H.com/%u]>
Would you like the proxy to issue a HTTP 307 redirection on DNS lookup failure?
[Y]>
Would you like proxy not to automatically failover to DNS results when upstream
proxy (peer) is unresponsive?
[N]>
Select one of the following options:
0 = Always use DNS answers in order
1 = Use client-supplied address then DNS
2 = Limited DNS usage
3 = Very limited DNS usage
For options 1 and 2, DNS will be used if Web Reputation is enabled.
For options 2 and 3, DNS will be used for explicit proxy requests, if there is
no upstream proxy or in the event the configured upstream proxy fails.
For all options, DNS will be used when Destination IP Addresses are used in
policy membership.
Find web server by:
[0]>
これらのオプションは、透過プロキシ展開でクライアント要求を評価する際に、SWAが接続先のIPアドレスをどのように決定するかを制御します。要求を受信すると、WSAは宛先IPアドレスとホスト名を確認します。SWAは、TCP接続の元の宛先IPアドレスを信頼するか、独自のDNS解決を実行して解決されたアドレスを使用するかを決定する必要があります。デフォルトは「0 = Always use DNS answers in order」です。これは、SWAがクライアントにIPアドレスを提供することを信頼しないことを意味します。
SWA_CLI> logconfig
Currently configured logs:
...
42. "system_logs" Type: "System Logs" Retrieval: FTP Poll
...
Choose the operation you want to perform:
- NEW - Create a new log.
- EDIT - Modify a log subscription.
- DELETE - Remove a log subscription.
- HOSTKEYCONFIG - Configure SSH host keys.
- AUDITLOGCONFIG - Adjust settings for audit logging.
[]> EDIT
Enter the number of the log you wish to edit:
[]> 42 <--- in this example the System_logs is number 42
Please enter the name for the log:
[system_logs]>
Log level:
1. Critical
2. Warning
3. Information
4. Debug
5. Trace
[3]> 4
....
SWA_CLI> commit
SWA_CLI> nslookup
Please enter the host or IP address to resolve.
[]> cisco.com
Choose the query type:
1. A the host's IP address
2. AAAA the host's IPv6 address
3. CNAME the canonical name for an alias
4. MX the mail exchanger
5. NS the name server for the named zone
6. PTR the hostname if the query is an Internet address,
otherwise the pointer to other information
7. SOA the domain's "start-of-authority" information
8. TXT the text information
[1]> 1
A=10.20.3.15 TTL=30m
TSWA_CLI> nslookup
Please enter the host or IP address to resolve.
[]> cisco.com
Choose the query type:
1. A the host's IP address
2. AAAA the host's IPv6 address
3. CNAME the canonical name for an alias
4. MX the mail exchanger
5. NS the name server for the named zone
6. PTR the hostname if the query is an Internet address,
otherwise the pointer to other information
7. SOA the domain's "start-of-authority" information
8. TXT the text information
[1]> 1
A=10.20.3.15 TTL=28m 49s
dig @10.1.1.1 www.cisco.com A
; <<>> DiG 9.16.8 <<>> @10.1.1.1 www.cisco.com A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58012
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
; COOKIE: 2cbc212c0877096701000000623db99b050bda7f896790e3 (good)
;; QUESTION SECTION:
;www.cisco.com. IN A
;; ANSWER SECTION:
www.cisco.com. 3600 IN CNAME origin-www.cisco.com.
www.cisco.com. 5 IN A 10.20.3.15
;; Query time: 115 msec
;; SERVER: 10.1.1.1#53(10.1.1.1)
;; WHEN: Fri Mar 25 12:46:19 GMT 2022
;; MSG SIZE rcvd: 111
digの使用：
dig [-s ] [-t] [-x ] [@] hostname [qtype]
Query a DNS server.
@ - Query the DNS server at this IP address
hostname - Record that you want to look up.
qtype - Query type: A, PTR, CNAME, MX, SOA, NS, TXT
options:
-s IP Address
Specify the source IP address.
-t
Make query over tcp.
-x IP Address
Do a reverse lookup on this IP address.
...
INFO: DNS Cache Stats: Entries 662, Expire 1697, Hits 88739, Misses 664, Reclaims 0
...
DNS Time 1.0 ms 349
DNS Time 1.6 ms 550
DNS Time 2.5 ms 374
DNS Time 4.0 ms 32
DNS Time 6.3 ms 35
DNS Time 10.0 ms 37
DNS Time 15.8 ms 301
DNS Time 25.1 ms 80
DNS Time 39.8 ms 136
DNS Time 63.1 ms 91
DNS Time 100.0 ms 12
DNS Time 158.5 ms 33
DNS Time 251.2 ms 14
DNS Time 398.1 ms 12
DNS Time 631.0 ms 45
DNS Time 1000.0 ms 120
DNS Time 1584.9 ms 73
DNS Time 2511.9 ms 296
DNS Time 3981.1 ms 265
DNS Time 6309.6 ms 190
イメージGUI - DNS設定の設定
イメージ：DNSの設定
イメージ：システムログ、ログレベルの変更
イメージ – DNSパケットをキャプチャするフィルタの追加
図 – DNS FAILエラー
フィードバック