此产品的文档集力求使用非歧视性语言。在本文档集中,非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言,文档中可能无法确保完全使用非歧视性语言。 深入了解思科如何使用包容性语言。
思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言,希望全球的用户都能通过各自的语言得到支持性的内容。 请注意:即使是最好的机器翻译,其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任,并建议您总是参考英文原始文档(已提供链接)。
本文档介绍如何将软件版本6.3.0引入的完全限定域名(FQDN)功能配置到Firepower管理中心(FMC)和Firepower威胁防御(FTD)。 此功能在思科自适应安全设备(ASA)中存在,但在FTD的初始软件版本中不存在。
Cisco 建议您了解以下主题:
本文档中的信息基于以下软件版本:
本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始(默认)配置。如果您的网络处于活动状态,请确保您了解所有命令的潜在影响。
在配置FQDN对象之前,请确保满足以下条件:
此功能将FQDN解析为IP地址,并在访问控制规则或预过滤器策略引用时使用后者过滤流量。
步骤1.配置“DNS服务器组对象”
Retries — 系统未收到响应时重试DNS服务器列表的次数(从0到10)。默认值为 2。
Timeout — 从1到30秒的秒数,再有一个尝试连接到下一个DNS服务器。默认时间为 2 秒钟。每次系统重试服务器列表时,此超时会加倍。
步骤2.配置DNS(平台设置)
到期条目计时器选项指定在DNS查找表的生存时间(TTL)到期后从其中删除已解析FQDN的IP地址的时间限制。删除条目需要重新编译表,因此频繁删除会增加设备上的进程负载。此设置实际上扩展了TTL。
轮询计时器选项指定设备查询DNS服务器以解析在网络对象组中定义的FQDN的时间限制。FQDN在轮询计时器过期或已解析的IP条目的TTL过期时(以先发生的情况为准)定期解析。
对于Firepower威胁防御6.3.0设备,如果未选择接口,并且诊断接口被禁用以进行DNS查找,则DNS解析将通过包括诊断接口的任何接口(应用dnsdomain-lookup any命令)进行。
如果未指定任何接口,并且未在诊断接口上启用DNS查找,则FTD使用数据路由表来确定接口。如果没有匹配项,则使用管理路由表。
如果启用,Firepower威胁防御将同时使用选定的数据接口和诊断接口进行DNS解析。请务必在“设备”>“设备管理”>“编辑设备”>“接口”页面上为诊断接口配置IP地址。
步骤3.配置对象网络FQDN
导航至对象>对象管理,在网络对象中指定选择FQDN选项。
步骤4.创建访问控制规则
创建具有以前FQDN对象的规则并部署策略:
注意:FQDN解析的第一个实例在访问控制策略中部署FQDN对象时发生
使用本部分可确定配置能否正常运行。
aleescob# show run dns DNS server-group DefaultDNS
aleescob# show run dns dns domain-lookup wan_1557 DNS server-group DNS_Test retries 3 timeout 5 name-server 173.38.200.100 domain-name aleescob.cisco.com DNS server-group DefaultDNS dns-group DNS_Test
object network obj-talosintelligence.com fqdn talosintelligence.com id 268434436
access-list CSM_FW_ACL_ remark rule-id 268434437: ACCESS POLICY: Aleescob_ACP - Mandatory access-list CSM_FW_ACL_ remark rule-id 268434437: L4 RULE: FQDN-ACL access-list CSM_FW_ACL_ advanced deny ip ifc lan_v1556 any ifc wan_1557 object obj-talosintelligence.com rule-id 268434437 event-log flow-start
# Start of AC rule. 268434437 deny 1 any any 2 any any any any (log dcforward flowstart) (dstfqdn 268434436) # End rule 268434437
注意:在此场景中,由于FQDN对象用于目标,因此它列为dstfqdn。
aleescob# show dns Name: talosintelligence.com Address: 2606:4700::6810:1b36 TTL 00:05:43 Address: 2606:4700::6810:1c36 TTL 00:05:43 Address: 2606:4700::6810:1d36 TTL 00:05:43 Address: 2606:4700::6810:1a36 TTL 00:05:43 Address: 2606:4700::6810:1936 TTL 00:05:43 Address: 104.16.27.54 TTL 00:05:43 Address: 104.16.29.54 TTL 00:05:43 Address: 104.16.28.54 TTL 00:05:43 Address: 104.16.26.54 TTL 00:05:43 Address: 104.16.25.54 TTL 00:05:43 aleescob# show fqdn FQDN IP Table: ip = 2606:4700::6810:1b36, object = obj-talosintelligence.com, domain = talosintelligence.com FQDN-ID = 268434436 ip = 2606:4700::6810:1c36, object = obj-talosintelligence.com, domain = talosintelligence.com FQDN-ID = 268434436 ip = 2606:4700::6810:1d36, object = obj-talosintelligence.com, domain = talosintelligence.com FQDN-ID = 268434436 ip = 2606:4700::6810:1a36, object = obj-talosintelligence.com, domain = talosintelligence.com FQDN-ID = 268434436 ip = 2606:4700::6810:1936, object = obj-talosintelligence.com, domain = talosintelligence.com FQDN-ID = 268434436 ip = 104.16.27.54, object = obj-talosintelligence.com, domain = talosintelligence.com FQDN-ID = 268434436 ip = 104.16.29.54, object = obj-talosintelligence.com, domain = talosintelligence.com FQDN-ID = 268434436 ip = 104.16.28.54, object = obj-talosintelligence.com, domain = talosintelligence.com FQDN-ID = 268434436 ip = 104.16.26.54, object = obj-talosintelligence.com, domain = talosintelligence.com FQDN-ID = 268434436 ip = 104.16.25.54, object = obj-talosintelligence.com, domain = talosintelligence.com FQDN-ID = 268434436 FQDN ID Detail: FQDN-ID = 268434436, object = obj-talosintelligence.com, domain = talosintelligence.com ip = 2606:4700::6810:1b36, 2606:4700::6810:1c36, 2606:4700::6810:1d36, 2606:4700::6810:1a36, 2606:4700::6810:1936, 104.16.27.54, 104.16.29.54, 104.16.28.54, 104.16.26.54, 104.16.25.54
firepower# show access-list
access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 object obj-talosintelligence.com rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 fqdn talosintelligence.com (resolved) rule-id 268434437 event-log flow-start 0x1b869cf8 access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 2606:4700::6810:1b36 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 2606:4700::6810:1c36 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 2606:4700::6810:1d36 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 2606:4700::6810:1a36 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 2606:4700::6810:1936 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 104.16.27.54 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 104.16.29.54 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 104.16.28.54 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 104.16.26.54 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 104.16.25.54 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f
access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 object obj-talosintelligence.com rule-id 268434437 event-log flow-start (hitcnt=4) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 fqdn talosintelligence.com (resolved) rule-id 268434437 event-log flow-start 0x1b869cf8 access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 2606:4700::6810:1b36 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 2606:4700::6810:1c36 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 2606:4700::6810:1d36 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 2606:4700::6810:1a36 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 2606:4700::6810:1936 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 104.16.27.54 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=4) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 104.16.29.54 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 104.16.28.54 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 104.16.26.54 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f access-list CSM_FW_ACL_ line 10 advanced deny ip ifc lan_v1556 any ifc wan_1557 host 104.16.25.54 (talosintelligence.com) rule-id 268434437 event-log flow-start (hitcnt=0) 0x51d8505f
aleescob# show cap in 13 packets captured 1: 18:03:41.558915 192.15.56.132 > 173.38.200.100 icmp: 192.15.56.132 udp port 59396 unreachable 2: 18:04:12.322126 192.15.56.132 > 72.163.4.161 icmp: echo request 3: 18:04:12.479162 72.163.4.161 > 192.15.56.132 icmp: echo reply 4: 18:04:13.309966 192.15.56.132 > 72.163.4.161 icmp: echo request 5: 18:04:13.462149 72.163.4.161 > 192.15.56.132 icmp: echo reply 6: 18:04:14.308425 192.15.56.132 > 72.163.4.161 icmp: echo request 7: 18:04:14.475424 72.163.4.161 > 192.15.56.132 icmp: echo reply 8: 18:04:15.306823 192.15.56.132 > 72.163.4.161 icmp: echo request 9: 18:04:15.463339 72.163.4.161 > 192.15.56.132 icmp: echo reply 10: 18:04:25.713662 192.15.56.132 > 104.16.27.54 icmp: echo request 11: 18:04:30.704232 192.15.56.132 > 104.16.27.54 icmp: echo request 12: 18:04:35.711480 192.15.56.132 > 104.16.27.54 icmp: echo request 13: 18:04:40.707528 192.15.56.132 > 104.16.27.54 icmp: echo request aleescob# sho cap asp | in 104.16.27.54 162: 18:04:25.713799 192.15.56.132 > 104.16.27.54 icmp: echo request 165: 18:04:30.704355 192.15.56.132 > 104.16.27.54 icmp: echo request 168: 18:04:35.711556 192.15.56.132 > 104.16.27.54 icmp: echo request 176: 18:04:40.707589 192.15.56.132 > 104.16.27.54 icmp: echo request
aleescob# sho cap in packet-number 10 trace 13 packets captured 10: 18:04:25.713662 192.15.56.132 > 104.16.27.54 icmp: echo request Phase: 1 Type: CAPTURE Subtype: Result: ALLOW Config: Additional Information: MAC Access list Phase: 2 Type: ACCESS-LIST Subtype: Result: ALLOW Config: Implicit Rule Additional Information: MAC Access list Phase: 3 Type: ROUTE-LOOKUP Subtype: Resolve Egress Interface Result: ALLOW Config: Additional Information: found next-hop 192.15.57.254 using egress ifc wan_1557 Phase: 4 Type: ACCESS-LIST Subtype: log Result: DROP Config: access-group CSM_FW_ACL_ global access-list CSM_FW_ACL_ advanced deny ip ifc lan_v1556 any ifc wan_1557 object obj-talosintelligence.com rule-id 268434437 event-log flow-start access-list CSM_FW_ACL_ remark rule-id 268434437: ACCESS POLICY: Aleescob_ACP - Mandatory access-list CSM_FW_ACL_ remark rule-id 268434437: L4 RULE: FQDN-ACL Additional Information:
Result: input-interface: lan_v1556 input-status: up input-line-status: up output-interface: wan_1557 output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule
> system support firewall-engine-debug Please specify an IP protocol: icmp Please specify a client IP address: 192.15.56.132 Please specify a server IP address: Monitoring firewall engine debug messages 192.15.56.132-8 > 104.16.29.54-0 1 AS 1 I 0 new firewall session 192.15.56.132-8 > 104.16.29.54-0 1 AS 1 I 0 DAQ returned DST FQDN ID: 268434436 192.15.56.132-8 > 104.16.29.54-0 1 AS 1 I 0 Starting with minimum 2, 'FQDN-ACL', and SrcZone first with zones 1 -> 2, geo 0 -> 0, vlan 0, inline sgt tag: untagged, ISE sgt id: 0, svc 3501, payload 0, client 2000003501, misc 0, user 9999997, icmpType 8, icmpCode 0 192.15.56.132-8 > 104.16.29.54-0 1 AS 1 I 0 Match found for FQDN id: 268434436 192.15.56.132-8 > 104.16.29.54-0 1 AS 1 I 0 match rule order 2, 'FQDN-ACL', action Allow 192.15.56.132-8 > 104.16.29.54-0 1 AS 1 I 0 MidRecovery data sent for rule id: 268434437,rule_action:2, rev id:2096384604, rule_match flag:0x0 192.15.56.132-8 > 104.16.29.54-0 1 AS 1 I 0 allow action 192.15.56.132-8 > 104.16.29.54-0 1 AS 1 I 0 deleting firewall session
iab_mode Off # Start of tunnel and priority rules. # These rules are evaluated by LINA. Only tunnel tags are used from the matched rule id. 268434439 fastpath any any any any any any any any (log dcforward both) (tunnel -1) 268434438 allow any any 1025-65535 any any 3544 any 17 (tunnel -1) 268434438 allow any any 3544 any any 1025-65535 any 17 (tunnel -1) 268434438 allow any any any any any any any 47 (tunnel -1) 268434438 allow any any any any any any any 41 (tunnel -1) 268434438 allow any any any any any any any 4 (tunnel -1) # End of tunnel and priority rules.
Phase: 4 Type: ACCESS-LIST Subtype: log Result: ALLOW Config: access-group CSM_FW_ACL_ global access-list CSM_FW_ACL_ advanced trust ip any object obj-talosintelligence.com rule-id 268434439 event-log both access-list CSM_FW_ACL_ remark rule-id 268434439: PREFILTER POLICY: Prefilter-1 access-list CSM_FW_ACL_ remark rule-id 268434439: RULE: FQDN_Prefilter Additional Information:
所有所需日志均从FMC故障排除中收集。要从FMC收集所有重要日志,请从FMC GUI运行故障排除。否则,在FMC Linux提示符下,运行sf_troubleshoot.pl。如果您发现问题,请向思科技术支持中心(TAC)提交FMC故障排除报告。
FMC日志
日志文件名/位置 |
目的 |
/opt/CSCOpx/MDC/log/operation/vmsshareddsvcs.log |
所有API调用 |
/var/opt/CSCOpx/MDC/log/operation/usmsharedsvcs.log |
所有API调用 |
/opt/CSCOpx/MDC/log/operation/vmsbesvcs.log |
CLI生成日志 |
/opt/CSCOpx/MDC/tomcat/logs/stdout.log |
Tomcat日志 |
/var/log/mojo.log |
莫霍日志 |
/var/log/CSMAgent.log |
CSM和DC之间的REST呼叫 |
/var/log/action_queue.log |
DC的操作队列日志 |
以下是UI中显示的错误/警告,用于FQDN和DNS服务器组对象和DNS设置:
错误/警告 |
场景 |
描述 |
名称包含无效字符。名称应以字母或下划线开头,后跟字母数字或特殊字符(-、_、+、)。 |
用户 配置错误名称 |
用户获知允许的 字符和最大范围。 |
默认域值无效 |
用户配置了错误的域名 |
用户将获知允许的字符和最大范围。 |
未为平台设置“mzafeiro_Platform_Settings”中的DNS选择接口对象。如果继续,DNS域名查找将在所有接口上进行 |
用户不为域查找选择任何接口 对于6.3后的设备 |
警告用户DNS 服务器组CLI将被应用 到所有接口。 |
未为平台设置“mzafeiro_Platform_Settings”中的DNS选择接口对象。如果继续,将不应用带有“DNS”的DNS服务器组 |
用户不为域查找选择任何接口 对于6.2.3设备 |
警告用户 DNS 服务器组CLI将不是 生成。 |
当FQDN在AC策略/预过滤器策略以外的策略中使用时,可能会发生此错误并显示在FMC UI中:
1)打开日志文件: /var/opt/CSCOpx/MDC/log/operation/usmsharedsvcs.log
2)检查验证消息,类似于:
“配置的网络无效。在设备[DeviceNames]上配置的网络[NetworksContainingFQDN]指FQDN"
3)建议的行动:
验证以下一个或多个策略是否已配置了包含FQDN对象的FQDN或组,并在删除这些对象后重新尝试部署该策略。
a)身份策略
b)包含应用于AC策略的FQDN的变量集
系统可以通过FTD CLI显示下一个:
> show dns INFO: no activated FQDN
在应用具有已定义fqdn的对象之前,DNS不会激活。应用对象后,将解析此问题。
问:带FQDN的Packet-tracer是否是排除故障的有效测试?
A:是,您可以将fqdn选项与packet-tracer一起使用。
问:FQDN规则多久更新一次服务器的IP地址?
A:它取决于DNS响应的TTL值。一旦TTL值过期,FQDN将再次通过新的DNS查询解析。
这还取决于在DNS服务器配置中定义的轮询计时器属性。轮询DNS计时器过期或解析的IP条目的TTL过期时(以先到者为准),FQDN规则会定期解析。
问:这对轮询DNS是否有效?
A:轮询DNS可无缝工作,因为此功能在FMC/FTD上使用DNS客户端,而轮询DNS配置在DNS服务器端。
问:低TTL DNS值是否有限制?
A:如果DNS响应带0 TTL,则FTD设备会向其添加60秒。在这种情况下,TTL值最小为60秒。
问:那么默认情况下,FTD保留默认值60秒?
A:用户始终可以在DNS服务器上使用Expire Entry Timer设置覆盖TTL。
问:它如何与任播DNS响应互操作?例如,DNS服务器可以根据地理位置为请求者提供不同的IP地址。是否可以请求FQDN的所有IP地址?像Unix上的dig命令一样?
A:是,如果FQDN能够解析多个IP地址,则所有IP地址都将推送到设备,并且AC规则会相应展开。
问:是否计划包含预览选项,以显示在进行任何事件更改之前推送命令?
A:这是通过Flex config提供的“预览”配置选项的一部分。预览已存在,但在Flex Config策略中隐藏。有个计划把它搬出去,变成通用的。
问:FTD上的哪个接口用于执行DNS查找?
A:可配置。当未配置接口时,FTD上的所有命名接口都将启用DNS查找。
问:每个受管NGFW是否单独执行其自己的DNS解析和FQDN IP转换,即使对具有相同FQDN对象的所有受管NGFW应用相同的访问策略?
A:Yes.
问:能否清除DNS缓存,以便FQDN ACL进行故障排除?
A:是,您可以在设备上执行clear dns和clear dns-hosts cache命令。
问:FQDN解析到底何时触发?
A:FQDN解析在AC策略中部署时发生。
问:是否只能清除单个站点的缓存?
A:Yes.如果您知道域名或IP地址,则可以清除该域名,但从ACL的角度看,没有这样的命令。例如,clear dns host agni.tejas.com命令用于逐个主机清除主机上的缓存,其关键字host与dns host agni.tejas.com中的关键字host相同。
问:是否可以使用通配符,如*.microsoft.com?
A:否。FQDN必须以数字或字母开头和结尾。仅允许字母、数字和连字符作为内部字符。
问:名称解析是在交流编译时执行,而不是在第一次或后续请求时执行?如果TTL低(小于交流编译时间、快速通量或其他情况),是否会丢失某些IP地址?
A:部署AC策略后,名称解析即会发生。根据TTL时间到期,续约将随之而来。
问:是否计划能够处理Microsoft的Office 365云IP地址(XML)列表?
A:此时不支持。
问:FQDN是否在SSL策略中可用?
A:暂时不是(软件版本6.3.0)。FQDN对象仅在源网络和目标网络中受支持,仅适用于AC策略。
问:是否有任何历史日志可提供有关已解析FQDN的信息?例如,与LINA系统日志类似。
A:要排除特定目标的FQDN故障,可以使用system support trace命令。跟踪显示数据包的FQDN ID。您可以比较ID进行故障排除。您还可以启用系统日志消息746015、746016来跟踪FQDN dns解析活动。
问:设备是否在连接表中记录FQDN与已解析的IP?
A:要排除特定目标的FQDN故障,可以使用system support trace命令,其中跟踪显示数据包的FQDN ID。您可以比较ID进行故障排除。计划将来在FMC的事件查看器中使用FQDN日志。
版本 | 发布日期 | 备注 |
---|---|---|
1.0 |
04-Aug-2019 |
初始版本 |