Specifying The Source Interface For Dns Packets; Configuring The Dns Trusted Interface - HP 5920 Series Configuration Manual

Step
1. Enter system view.
2. Enable DNS proxy.
3. Enable DNS spoofing and
specify the translated IP
address.

Specifying the source interface for DNS packets

By default, the device uses the primary IP address of the output interface of the matching route as the
source IP address of a DNS request. Therefore, the source IP address of the DNS packets may vary with
DNS servers. In some scenarios, the DNS server only responds to DNS requests sourced from a specific
IP address. In such cases, you must specify the source interface for the DNS packets so that the device
can always uses the primary IP address of the specified source interface as the source IP address of DNS
packets.
When sending IPv4 DNS request, the device uses the primary IPv4 address of the source interface as the
source IP address of the DNS request. When sending IPv6 DNS request, the device selects an IPv6
address from the addresses configured on the source interface as defined in RFC 3484 as the source IP
address of the DNS request. If no IP address is configured on the source interface, the DNS packet fails
to be delivered.
You can configure only one source interface on the public network or a VPN. When you configure a new
source interface, the last configuration takes effect. You can configure the source interface for the public
network and a maximum of 1024 VPNs.
To specify the source interface for DNS packets:
Step
1. Enter system view.
2. Specify the source
interface for DNS
packets.

Configuring the DNS trusted interface

By default, an interface obtains DNS suffix and domain name server information from DHCP. The
network attacker may act as the DHCP server to assign wrong DNS suffix and domain name server
address to the device. As a result, the device fails to get the resolved IP address or may get the wrong IP
address. With the DNS trusted interface specified, the device only uses the DNS suffix and domain name
server information obtained through the trusted interface to avoid attack.
Command
system-view
dns proxy enable
•
Specify a translated IPv4 address:
dns spoofing ip-address
[ vpn-instance
vpn-instance-name ]
•
Specify a translated IPv6 address:
ipv6 dns spoofing ipv6-address
[ vpn-instance
vpn-instance-name ]
Command
system-view
dns source-interface interface-type
interface-number [ vpn-instance
vpn-instance-name ]
80
Remarks
N/A
By default, DNS proxy is disabled.
Use at least one command.
By default, no translated IP
address is specified.
Remarks
N/A
By default, no source interface for
DNS packets is specified.
If you specify the vpn-instance
vpn-instance-name option, make
sure the source interface is on the
specified VPN.