我想配置我们的 Cisco，以便他们可以进行正向 DNS 解析，但不能从 CLI 进行反向 DNS 解析。
R01(config)#ip domain-name domain.local
R01(config)#ip name-server 10.1.1.1
R01(config)#ip domain-lookup
该配置使路由器在我们 ping 时进行正向查找，并在返回 IP 地址的 show 命令下进行反向查找。当我们执行“show user”操作时，路由器会对每个源 IP 地址进行反向查找。当我们打开“ip domain-lookup”时，看起来我们同时进行了正向和反向查找。有没有办法关闭反向查找并保持正向查找？
有没有办法关闭反向查找并保持正向查找？
no domain-lookup在line vty 0 4...下使用
你是对的，默认行为是在 show 命令中执行和缓存地址的正向/反向查找。这个配置开始类似于你的......
HotCoffee#clear host *
HotCoffee#sh runn | i ip domain|ip name|^ +domain|NTP
Time source is NTP, 06:10:42.327 CDT Tue Aug 13 2013
ip domain name pennington.net
ip name-server 172.16.1.5
domain-name pennington.net
HotCoffee#
清除主机缓存后，里面没有任何条目...
HotCoffee#show host
Load for five secs: 0%/0%; one minute: 1%; five minutes: 1%
Time source is NTP, 06:11:46.864 CDT Tue Aug 13 2013
Default domain is pennington.net
Name/address lookup uses domain service
Name servers are 172.16.1.5
Codes: UN - unknown, EX - expired, OK - OK, ?? - revalidate
temp - temporary, perm - permanent
NA - Not Applicable None - Not defined
Host Port Flags Age Type Address(es)
HotCoffee#
执行show user或ping填充主机缓存...
HotCoffee#sh user
Line User Host(s) Idle Location
* 66 vty 0 cisco idle 00:00:00 tsunami.pennington.net
Interface User Mode Idle Peer Address
HotCoffee#ping flame
Translating "flame"...domain server (172.16.1.5)
Translating "flame"...domain server (172.16.1.5) [OK]
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms
HotCoffee#
现在ping目标和show user...的主机条目都有了。
HotCoffee#sh hosts
Load for five secs: 1%/0%; one minute: 0%; five minutes: 0%
Time source is NTP, 06:16:32.811 CDT Tue Aug 13 2013
Default domain is pennington.net
Name/address lookup uses domain service
Name servers are 172.16.1.5
Codes: UN - unknown, EX - expired, OK - OK, ?? - revalidate
temp - temporary, perm - permanent
NA - Not Applicable None - Not defined
Host Port Flags Age Type Address(es)
tsunami.pennington.net None (temp, OK) 0 IP 172.16.1.5
flame.pennington.net None (temp, OK) 0 IP 172.16.1.1
flame None (temp, UN) 0 IPv6
HotCoffee#
使用no domain-lookup的VTY /控制台线下限制IOS行为只能向前查找...
HotCoffee#conf t
Enter configuration commands, one per line. End with CNTL/Z.
HotCoffee(config)#line vty 0 4
HotCoffee(config-line)#no domain-lookup
HotCoffee(config-line)#end
HotCoffee#
首先，我清除主机缓存以进行干净的测试...
HotCoffee#clear host *
HotCoffee#
HotCoffee#
show user 以前在 172.16.1.5 上执行反向查找以及填充主机缓存，但现在都没有发生......
HotCoffee#sh user
Load for five secs: 1%/0%; one minute: 0%; five minutes: 0%
Time source is NTP, 06:20:00.250 CDT Tue Aug 13 2013
Line User Host(s) Idle Location
* 66 vty 0 cisco idle 00:00:00 172.16.1.5 <----
Interface User Mode Idle Peer Address
HotCoffee#
HotCoffee#sh host
Load for five secs: 2%/0%; one minute: 0%; five minutes: 0%
Time source is NTP, 06:20:06.729 CDT Tue Aug 13 2013
Default domain is pennington.net
Name/address lookup uses domain service
Name servers are 172.16.1.5
Codes: UN - unknown, EX - expired, OK - OK, ?? - revalidate
temp - temporary, perm - permanent
NA - Not Applicable None - Not defined
Host Port Flags Age Type Address(es)
<----
HotCoffee#
只是为了表明正向查找仍然有效......
HotCoffee#
HotCoffee#ping flame
Translating "flame"...domain server (172.16.1.5)
Translating "flame"...domain server (172.16.1.5) [OK]
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
HotCoffee#
HotCoffee#
HotCoffee#
HotCoffee#sh hosts
Load for five secs: 0%/0%; one minute: 0%; five minutes: 0%
Time source is NTP, 06:25:43.237 CDT Tue Aug 13 2013
Default domain is pennington.net
Name/address lookup uses domain service
Name servers are 172.16.1.5
Codes: UN - unknown, EX - expired, OK - OK, ?? - revalidate
temp - temporary, perm - permanent
NA - Not Applicable None - Not defined
Host Port Flags Age Type Address(es)
tsunami.pennington.net None (temp, OK) 0 IP 172.16.1.5
flame.pennington.net None (temp, OK) 0 IP 172.16.1.1
flame None (temp, UN) 0 IPv6
HotCoffee#