要通过管理网络访问DNS服务器,用户必须明确选择“Enable DNS Lookup via diagnostic/Management Interface also”。 在Platform Settings > DNS configuration上,DNS查找和ICMP(ping和traceroute)设置为例外:在这些情况下,threat defense使用数据,如果没有找到路由,则自动回退到管理层。
管理接口使用静态路由只能通过FTD CLI类(Linux)配置
Lina管理端口默认路由将所有帧发送到Linux模块。
> configure network static-routes ipv4 add management ?
IP address AAA.BBB.CCC.DDD where each part is in the range 0-255 destination address
在FMC UI上,管理界面灰显以供选择。
合并完成后,管理接口不可用于静态路由选择。
验证
在管理接口上合并后预期的更改
通过执行命令检验FTD CLI的收敛模式关闭
> show management-interface convergence
management-interface convergence
FTD CLI Clish:
> show interface management
Interface Management0/0 "management", is up, line protocol is up
Hardware is en_vtun rev00, DLY 10 usec
Input flow control is unsupported, output flow control is unsupported
MAC address 0050.56b3.f75d, MTU 1500
IP address 203.0.113.130, subnet mask 255.255.255.248
Expert mode on Linux:
root@ftd01:/home/admin# ifconfig
...
tap5: flags=4419 mtu 1500
inet 203.0.113.129 netmask 255.255.255.248 broadcast 203.0.113.135
inet6 fe80::8403:9ff:fefb:6d16 prefixlen 64 scopeid 0x20
inet6 fd00:0:1:1::1 prefixlen 123 scopeid 0x0
interface Management0/0
management-only
nameif diagnostic
cts manual
propagate sgt preserve-untag
policy static sgt disabled trusted
security-level 0
ip address 192.168.40.74 255.255.255.0
ftd01# sh ip
System IP Addresses:
Interface Name IP address Subnet mask Method
Management0/0 diagnostic 192.168.40.74 255.255.255.0 manual
Current IP Addresses:
Interface Name IP address Subnet mask Method
Management0/0 diagnostic 192.168.40.74 255.255.255.0 manual
ftd01# sh route management-only
Routing Table: mgmt-only
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is not set
S 10.10.10.10 255.255.255.255 [1/0] via 192.168.40.254, diagnostic
C 192.168.40.0 255.255.255.0 is directly connected, diagnostic
L 192.168.40.74 255.255.255.255 is directly connected, diagnostic
FTD CLI链路上的DNS配置
ftd01# sh run dns
dns domain-lookup diagnostic
DNS server-group DNS_Server_lab
retries 5
timeout 15
name-server 10.10.10.10 diagnostic
domain-name test.lab
DNS server-group DefaultDNS
dns-group DNS_Server_lab
在诊断接口上捕获流向DNS服务器10.10.10.10的DNS流量
ftd01# sh cap
capture diag type raw-data trace detail interface diagnostic [Capturing - 340 bytes]
match udp any host 10.10.10.10 eq domain
ftd01# sh cap diag
5 packets captured
1: 00:15:39.660442 192.168.40.74.59939 > 10.10.10.10.53: udp 27
2: 00:15:54.661953 192.168.40.74.59939 > 10.10.10.10.53: udp 27
3: 00:16:09.661739 192.168.40.74.59939 > 10.10.10.10.53: udp 27
4: 00:16:24.667674 192.168.40.74.59939 > 10.10.10.10.53: udp 27
5: 00:16:39.684946 192.168.40.74.59939 > 10.10.10.10.53: udp 27
5 packets shown
ftd01#
在Linux expert模式下捕获,以确认管理接口上来自诊断接口的DNS查找流量的正确流
root@ftd01:/home/admin# tcpdump -i br1 port 53
HS_PACKET_BUFFER_SIZE is set to 4.
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br1, link-type EN10MB (Ethernet), capture size 262144 bytes
04:58:14.648941 IP 192.168.40.74.49171 > 10.10.10.10.domain: 5655+ AAAA? cisco.com. (27)
04:58:29.656317 IP 192.168.40.74.11606 > 10.10.10.10.domain: 26905+ A? cisco.com. (27)
04:58:44.686568 IP 192.168.40.74.11606 > 10.10.10.10.domain: 24324+ A? cisco.com. (27)
04:58:59.704586 IP 192.168.40.74.11606 > 10.10.10.10.domain: 35592+ A? cisco.com. (27)
04:59:14.742685 IP 192.168.40.74.11606 > 10.10.10.10.domain: 40993+ A? cisco.com. (27)
04:59:29.763690 IP 192.168.40.74.11606 > 10.10.10.10.domain: 62225+ A? cisco.com. (27)
04:59:44.796484 IP 192.168.40.74.11606 > 10.10.10.10.domain: 25350+ A? cisco.com. (27)
为了使DNS查找继续发送到管理接口,而无需添加静态路由,请输入“Enable DNS Lookup via diagnostic/Management interface also”。 必须保持选定状态。
平台设置上的DNS配置通过诊断/管理接口启用DNS查找的选项也必须保持相同
FTD CLI上的配置
> show interface management
Interface Management0/0 "management", is up, line protocol is up
Hardware is en_vtun rev00, DLY 10 usec
Input flow control is unsupported, output flow control is unsupported
MAC address 0050.56b3.f75d, MTU 1500
IP address 203.0.113.130, subnet mask 255.255.255.248
> show interface ip brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 unassigned YES unset administratively down up
GigabitEthernet0/1 unassigned YES unset administratively down up
GigabitEthernet0/2 unassigned YES unset administratively down up
Internal-Control0/0 127.0.1.1 YES unset up up
Internal-Control0/1 unassigned YES unset up up
Internal-Data0/0 unassigned YES unset down up
Internal-Data0/0 unassigned YES unset up up
Internal-Data0/1 169.254.1.1 YES unset up up
Internal-Data0/2 unassigned YES unset up up
Management0/0 203.0.113.130 YES unset up up
ftd01# sh route management-only
Routing Table: mgmt-only
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is not set
LINA端的FTD CLI上的DNS配置
ftd01# sh run dns
dns domain-lookup management
DNS server-group DNS_Server_lab
retries 5
timeout 15
name-server 10.10.10.10 management
domain-name test.lab
DNS server-group DefaultDNS
dns-group DNS_Server_lab
在Linux expert模式下捕获,以确认DNS查找流量在管理接口上的正确流动。
root@ftd01:/home/admin# tcpdump -i br1 port 53
HS_PACKET_BUFFER_SIZE is set to 4.
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br1, link-type EN10MB (Ethernet), capture size 262144 bytes
20:20:33.623146 IP ftd01.60310 > 10.10.10.10.domain: 61954+ A? cisco.com. (27)
20:20:33.623533 IP ftd01.33417 > umbrella.domain: 20595+ PTR? 10.10.10.10.in-addr.arpa. (42)
20:20:48.660172 IP ftd01.60310 > 10.10.10.10.domain: 41252+ A? cisco.com. (27)
20:20:52.638426 IP ftd01.39304 > umbrella.domain: 20595+ PTR? 10.10.10.10.in-addr.arpa. (42)
20:21:09.669133 IP ftd01.47150 > umbrella.domain: 39343+ AAAA? ftd01. (23)
20:21:09.669305 IP ftd01.50173 > umbrella.domain: 57694+ AAAA? ftd01. (23)
20:21:11.659352 IP ftd01.48092 > umbrella.domain: 46478+ PTR? opendns.in-addr.arpa. (45)
20:21:14.673992 IP ftd01.58547 > umbrella.domain: 57694+ AAAA? ftd01. (23)
20:21:18.673371 IP ftd01.47607 > umbrella.domain: 39343+ AAAA? ftd01. (23)
20:21:18.695507 IP ftd01.60310 > 10.10.10.10.domain: 29973+ A? cisco.com. (27)