4000 Router Series Layer 3 - IP Services Command Reference

ManualsBrandsHP ManualsNetwork HardwareHP MSR3024 TAA-compliant AC Router

111

112

113

114

115

116

117

118

119

120

107

Parameters

ip-address: Specifies the IPv4 address used to spoof name query requests.

vpn-instance vpn-instance-name: Specifies the name of an MPLS L3VPN instance, a case-sensitive string

of 1 to 31 characters. To enable DNS spoofing function on the public network, do not use this option.

Usage guidelines

Use the dns spoofing command together with the dns proxy enable command. DNS spoofing enables

the DNS proxy to send a spoofed reply with a configured IP address even if it cannot reach the DNS

server because no dial-up connection is available. Without DNS spoofing, the proxy does not answer

or forward a DNS request if it cannot find a local matching DNS entry or reach the DNS server.

You can configure DNS spoofing for the public network and a maximum of 1024 VPNs, and can specify

only one replied IPv4 address on the DNS spoofing device for the public network or each VPN.

If you use the command multiple times, the most recent configuration takes effect.

Examples

# Enable DNS spoofing on the public network and specify the IPv4 address 1.1.1.1 to spoof DNS

requests.

<Sysname> system-view

[Sysname] dns proxy enable

[Sysname] dns spoofing 1.1.1.1

Related commands

dns proxy enable

dns trust-interface

Use dns trust-interface to specify the DNS trusted interface.

Use undo dns trust-interface to remove the specified DNS trusted interface. If no interface is specified, the

undo dns trust-interface command removes all DNS trusted interfaces.

Syntax

dns trust-interface interface-type interface-number

undo dns trust-interface [ interface-type interface-number ]

Default

No trusted interface is specified.

Views

System view

Predefined user roles

network-admin

Parameters

interface-type interface-number: Specifies an interface by its type and number.

Usage guidelines

By default, an interface obtains DNS suffix and DNS server information from DHCP. A network attacker

might act as the DHCP server to assign wrong DNS suffix and DNS server address to the device. As a

result, the device fails to obtain the resolved IP address or might get the wrong IP address. With the DNS