According with Cisco
(http://cisco.biz/en/US/docs/routers/10000/10008/configuration/guides/ancp/isbl4rdt.html#wp1043711)
I create the next configuration:
!----------------------------------------------------------------------------------------------------------
ip access-list extended DNS-Traffic
10 permit tcp any eq 53 any eq 53
20 permit udp any eq 53 any eq 53
30 permit tcp any gt 1024 any eq 53
40 permit udp any gt 1024 any eq 53
service-policy type control DNS-redirection
policy-map type control DNS-redirection
class type control event session-start
1 service-policy type service name DNS-redirection-profile
policy-map type service DNS-redirection-profile
class type traffic DNS-Traffic
! maybe could be possible to use "match protocol dns" pending to test it
match access-group DNS-Traffic
redirect to group DNS-servers
redirect server-group DNS-servers
! are they going to do load balance? is it possible?
server ip 10.53.0.235 port 53
server ip 10.53.0.236 port 53
!----------------------------------------------------------------------------------------------------------
Questions:
- should I do modify the default timers (frequency and concurrent sessions)
- how is considered the value "sessions"? by ip? by request?
- what about the CPU? too much impact? any experience?
Alternatives with less impact to redirect DNS traffic? :]
Thanks in advance to all the list.
Luis
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
