How to perform DNS resolution for L2TP users on the AR

In V2R5C90 and V200R006C10, an Huawei AR supports the DNS resolution policy. That is, access control can be performed for some sites based on the domain name. The DNS resolution policy is supported only when the AR functions as the DNS proxy or relay agent. DNS resolution policy rules are configured using the rule rule-id [ if-match name hostname ] { deny | permit | spoofing ip-address } command. The domain name hostname can be parsed or not parsed, or a spoofing response is sent. rule-id specifies the DNS resolution rule ID. A smaller value indicates a higher priority of the rule. If the specified rule ID already exists, the new rule will overwrite the existing rule. The configuration procedure is as follows: [Huawei] dns proxy enable //Enable the DNS proxy function, or run the dns relay enable command to enable the DNS relay function. [Huawei] dns resolve //Enable dynamic domain name resolution. [Huawei] dns server 10.3.1.2 //Configure the IP address of the DNS server. [Huawei] dns resolve policy a //Enter the DNS resolution policy view. [Huawei-dns-resolve-policy-a] rule 0 if-match name www.huawei.com permit //Configure the rule to 0. If the domain name is www.huawei.com, parsing is allowed. [Huawei-dns-resolve-policy-a] rule 1 spoofing 192.168.1.1 //For other domain names, a spoofing response is sent with the response address of 192.168.1.1.

Host resolution is implemented by DNS. The ip host command can be used to configure static DNS entries.

What if the firewall DNS Client cannot perform dynamic domain name resolution? Symptom The firewall serves as the DNS Client and has the dynamic domain name resolution function configured. However, it cannot obtain the correct IP address based on domain name resolution. Operation steps 1. Run the display dns dynamic-host command to check whether the dynamic domain name cache information contains the specified domain name. If no, check whether the communication between the DNS Client and DNS Server is normal, whether the DNS Server works properly, and whether the dynamic domain name resolution function has been enabled. If yes, but the IP address is incorrect. Go to step 2. 2. Run the display dns server command to check the DNS Server configuration information. Check whether the DNS Server IP address configured on the DNS Client is correct. If the DNS Server address is incorrect, run the undo dns server ip-address command to delete the configured DNS Server address and then run the dns server ip-address command to configure a correct DNS Server address.

The USG2000, USG5000, and USG6000 support DNS resolution. However, they must be configured as DHS clients instead of DNS servers.

You can use either of the following methods: -Use the DNS server address specified in the address pool. 1.Create an address pool and specify the DNS server address in the address pool. system-view [sysname] ip pool l2tp_pool [sysname-pool-l2tp_pool] section 0 1.1.1.1 1.1.1.10 [sysname-pool-l2tp_pool] dns-list 2.2.2.1 //Change the DNS server address to the actual address. [sysname-pool-l2tp_pool] quit 2.Create a service scheme and reference the address pool.[sysname] aaa [sysname-aaa] service-scheme srvscheme1 [sysname-aaa-service-srvscheme1] ip-pool l2tp_pool //Change the DNS server address to the actual address. 3.Reference the service scheme in the authentication domain. system-view [sysname] aaa [sysname-aaa] domain domain1 //Change the authentication domain to the one used when you configure L2TP. [sysname-aaa-domain1] service-scheme srvscheme1 -Use the DNS server address specified in the service scheme. 1.Create a service scheme. system-view [sysname] aaa [sysname-aaa] service-scheme srvscheme1 [sysname-aaa-service_srvscheme1] dns 2.2.2.1 //Change the DNS server address to the actual address. 2.Reference the service scheme in the authentication domain. system-view [sysname] aaa [sysname-aaa] domain domain1 //Change the authentication domain to the one used when you configure L2TP. [sysname-aaa-domain-domain1] service-scheme srvscheme1 //Reference the service scheme in the authentication domain. If DNS server addresses are specified in both the address pool and service scheme, the DNS server address specified in the address pool is preferentially used.