Description

This article provides information about the DNS cache refresh interval on SRX platforms and the related configuration of security policy traceoptions.



Symptoms

How do users find out the DNS cache refresh interval on SRX platforms using security policy traceoptions, when domain names are used in the security zone's address-book and subsequently in the security policies?

For more information, refer to KB20994 - [SRX] Configuration example using fully qualified domain names in security policies [juniper.net] .


Solution


In Junos OS 11.4 and earlier:

In order to find out the DNS refresh interval, security policy traceoptions with flag all must be configured on SRX. The TTL value in front of the policy_dns_refresh_update_entry indicates the refresh interval in the resulting logs for every single domain name.

[edit]
root@user# run show configuration | display set | match "security policies traceoptions"
set security policies traceoptions file DnsPolicyTrace
set security policies traceoptions file files 2
set security policies traceoptions file world-readable
set security policies traceoptions flag all

[edit]
root@user# run start shell
root@user% grep policy_dns_refresh_update_entry DnsPolicyTrace
Jan 12 14:16:44 policy_dns_refresh_update_entry: DNS entry abc.com has been refreshed. (ttl = 1 min).
Jan 12 14:16:44 policy_dns_refresh_update_entry: DNS entry xyz.com has been refreshed. (ttl = 1 min).

Here, the logs show a DNS refresh interval of 1 minute (ttl = 1 min) for these domain names, but this value can be different for other domain names.

Deactivate traceoptions and commit:

root@user% cli
root@user> edit
Entering configuration mode

[edit]
root@user# deactivate security policies traceoptions

[edit]
root@user# commit
commit complete

Beginning in Junos OS 12.1X44-D10 and later:

Determine the TTL of each DNS entry used in a policy with the command show security dns-cache : 

root# run show security dns-cache    
DNS Name: test.abc.com
  Address Family: IPv4, TTL: 43
    IP Address: 5.5.5.5
DNS Name: www.google.com
  Address Family: IPv4, TTL: 142
    IP Address: 10.10.10.147
    IP Address: 10.10.10.144
    IP Address: 10.10.10.146
    IP Address: 10.10.10.145
    IP Address: 10.10.10.148
DNS entry number: 2

[edit]
root#