Cisco Catalyst 4500 Series Software Configuration Guide

45-4
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 45 Configuring AVC with DNS-AS
About AVC with DNS-AS
AVC with DNS-AS Process Flow
This involves the DNS snooping process and the DNS-AS client process—both of which are loosely
coupled, but independent processes. Figure 45-1 is a representation of both processes.
Part -I: DNS Snooping Process
Step 1 The host initiates an “A” record request.
A user from your organization is in a meeting room in an office building. The associated
DNS-AS client here is a switch (the wired network traffic from this meeting room is routed
through this switch). The user looks up a website www.example.com, which initiates the request
for an “A” record.
Step 2 The authoritative DNS-server responds with an “A” record response.
Part-II: DNS-AS Client Process
Step 1 The DNS-AS client sends a DNS query (TXT request) to the authoritative DNS server.
The DNS-AS client, which is constantly snooping for requests (based on the trusted domain
list), finds the host’s forward look-up request.
Note The DNS-AS client receives a copy of the host’s “A” record request, and does not alter
the host’s original request in any manner.
Based on the snooped result, the DNS-AS client sends a TXT request to the authoritative DNS
server.
Step 2 The authoritative DNS-server responds with a TXT record response.
Step 3 A successful TXT response is followed by an “A” record request.
Step 4 The authoritative DNS-server responds with an “A” record response.
Step 5 The DNS-AS client parses and saves the response in its binding table.
The DNS-AS client saves the TXT record and “A” record in its binding table. The response will
remain saved in the binding table for the duration specified by the TTL of the “A” record. The
system automatically checks and prevents duplicate entries for a fully qualified domain name
in the binding table.
The DNS-AS client applies a QoS policy based on the metadata from the DNS server, and
exports application information to a collector, based on how the flow record is configured.
The DNS-AS client forwards information about identified applications to FNF, enabling you to
export this information.

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E