Chapitre 6
Chapter 06: DNS et DHCP
Chapter 06: DNS et DHCP
Chapter 06: DNS et DHCP
1. DNS (Domain Name System)
1.1 DNS Hierarchy
Diagramme en cours de génération...
Root Servers: 13 logical root servers (lettered A-M), with many instances via anycast.
TLD Types:
- gTLD: Generic (.com, .org, .net, .info)
- ccTLD: Country code (.fr, .uk, .jp, .de)
- new gTLD: .blog, .app, .dev, .cloud
1.2 DNS Resolution Process
Diagramme en cours de génération...
1.3 DNS Records
| Record | Purpose | Example |
|---|---|---|
| A | IPv4 address | example.com → 93.184.216.34 |
| AAAA | IPv6 address | example.com → 2606:2800:220:1:248:1893:25c8:1946 |
| CNAME | Canonical name (alias) | www.example.com → example.com |
| MX | Mail exchange | @ → mail.example.com (priority 10) |
| NS | Name server | example.com → ns1.example.com |
| SRV | Service locator | _sip._tcp.example.com → server:5060 |
| TXT | Text (SPF, DKIM, verification) | v=spf1 include:_spf.google.com ~all |
| PTR | Reverse pointer | 34.216.184.93.in-addr.arpa → example.com |
| SOA | Start of Authority | Zone parameters, serial, refresh |
1.4 DNS Message Format
Diagramme en cours de génération...
1.5 DNS Caching
Diagramme en cours de génération...
TTL (Time To Live):
- Short TTL (60s): Load balancing, fast changes
- Medium TTL (300-3600s): Normal records
- Long TTL (86400s): Stable records (NS, MX)
1.6 DNS Security
DNSSEC (DNS Security Extensions):
Diagramme en cours de génération...
DNS over TLS (DoT - RFC 7858):
- TCP port 853
- Encrypted DNS queries
- Prevents snooping
DNS over HTTPS (DoH - RFC 8484):
- TCP port 443
- DNS queries in HTTPS
- Harder to block
DNS over QUIC (DoQ - RFC 9250):
- Uses QUIC transport
- Lower latency than TCP
1.7 Anycast DNS
Diagramme en cours de génération...
Same IP address advertised from multiple locations via BGP. Traffic goes to the closest instance.
1.8 Split DNS (Split-Horizon)
Diagramme en cours de génération...
Internal users get private IPs; external users get public IPs.
2. DHCP (Dynamic Host Configuration Protocol)
2.1 DORA Process
Diagramme en cours de génération...
2.2 DHCP Options
| Option | Code | Description |
|---|---|---|
| Subnet Mask | 1 | 255.255.255.0 |
| Router | 3 | Default gateway |
| DNS Server | 6 | DNS resolver |
| Domain Name | 15 | example.local |
| Lease Time | 51 | 86400 seconds |
| T1 (Renewal) | 58 | 50% of lease |
| T2 (Rebinding) | 59 | 87.5% of lease |
| NTP Server | 42 | Time server |
| TFTP Server | 66 | PXE boot server |
| Bootfile | 67 | PXE boot filename |
2.3 DHCP Lease States
Diagramme en cours de génération...
2.4 DHCP Relay
Diagramme en cours de génération...
Relay Agent Information (Option 82):
- Identifies the client's subnet/VLAN
- Prevents rogue DHCP servers
! Cisco IOS DHCP Relay
interface Vlan10
ip address 192.168.10.1 255.255.255.0
ip helper-address 10.0.0.1
2.5 DHCPv6
Diagramme en cours de génération...
| Message Type | Name | Description |
|---|---|---|
| SOLICIT | 1 | Client discovers servers |
| ADVERTISE | 2 | Server responds |
| REQUEST | 3 | Client requests configuration |
| REPLY | 7 | Server sends config |
| RELEASE | 8 | Client releases address |
| INFORMATION-REQUEST | 11 | Client requests options only |
2.6 DHCP Snooping
Security feature that filters untrusted DHCP messages.
ip dhcp snooping
ip dhcp snooping vlan 10,20
!
interface GigabitEthernet0/1
ip dhcp snooping trust ! Uplink to DHCP server
!
interface FastEthernet0/1
ip dhcp snooping limit rate 5 ! Limit client requests
3. IPAM (IP Address Management)
IPAM combines DNS, DHCP, and IP address tracking.
Key features:
- Centralized address management
- Subnet utilization tracking
- Automated DNS/DHCP updates
- Audit logging
- Integration with network automation
Common IPAM tools:
- Infoblox
- SolarWinds IPAM
- phpIPAM (open source)
- NetBox (open source)
- Microsoft IPAM
4. Dynamic DNS (DDNS)
Clients update DNS records when their IP changes.
Diagramme en cours de génération...
5. Summary
| Service | Port | Protocol | Function |
|---|---|---|---|
| DNS | 53 | TCP/UDP | Name resolution |
| DNS over TLS | 853 | TCP | Encrypted DNS |
| DNS over HTTPS | 443 | TCP | DNS via HTTP/2 |
| DHCPv4 | 67/68 | UDP | IP configuration |
| DHCPv6 | 546/547 | UDP | IPv6 configuration |
6. Exercises
Exercise 1: DNS Resolution
Trace the resolution steps for www.example.com from a client with recursive resolver 8.8.8.8.
Exercise 2: DHCP Troubleshooting
A client cannot obtain an IP via DHCP. List 5 possible causes and their solutions.
Exercise 3: DNS Record Configuration
Write zone file entries for:
- A record: server1 → 192.168.1.10
- CNAME: www → server1.example.com
- MX: @ → mail.example.com (priority 10)
- TXT: SPF record v=spf1 ip4:192.168.1.0/24 -all
- SRV: _sip._tcp → sipserver:5060 (priority 10, weight 20)
Exercise 4: DHCP Scope Design
Design a DHCP scope for VLAN 10 (192.168.10.0/24) with:
- 200 hosts
- Exclusion for first 10 addresses
- DNS: 8.8.8.8, 8.8.4.4
- Gateway: 192.168.10.1
- Lease: 8 hours