Manual Chapter :
Configuring DNS Express
Applies To:
Show VersionsBIG-IP LTM
- 14.0.1, 14.0.0
BIG-IP DNS
- 14.0.1, 14.0.0
Configuring DNS Express
What is DNS Express?
DNS Express is an engine that provides the ability for the BIG-IP system to act as a high-speed, authoritative DNS server. With DNS
Express configured, the BIG-IP system can answer DNS queries for a DNS zone and respond to zone
transfer requests from specified DNS nameservers (clients). Additionally, zone transfer
communications can be secured with TSIG keys.
About configuring DNS
Express
You can configure the BIG-IP
system to use the DNS Express engine to answer queries
for a DNS zone. This involves a zone transfer from the authoritative DNS server into DNS Express
and then DNS Express can answer DNS queries for the zone. For this configuration you create the
following objects in the order described.
- TSIG key (optional)
- Obtain the TSIG key data from the authoritative DNS server that hosts the zone and create a TSIG key object.
- Nameserver object
- Create a nameserver object to represent the authoritative DNS server. Optionally, add the TSIG key.
- DNS zone
- Create a zone object and in the DNS Express area, select the nameserver object that represents the authoritative DNS server that hosts the zone.
- Custom DNS profile (optional)
- Create a custom DNS profile based on your network architecture.
- DNS listener or LTM virtual server
- Create a DNS listener or LTM virtual server and select a DNS profile. You can use either the default DNS profile or the custom DNS profile.
Additionally, you can configure the BIG-IP system to use the DNS Express
engine to answer zone transfer requests for a DNS zone from a DNS nameserver that answers DNS
queries. For this configuration you create or modify the following objects in the order
described.
- TSIG key (optional)
- Obtain the TSIG key data from the DNS nameserver client that you want to allow to send zone transfer requests for the DNS zone and create a TSIG key object.
- Nameserver object
- Create a nameserver object to represent the DNS nameserver that will make the zone transfer request. Optionally, add the TSIG key.
- DNS zone
- Modify the zone object to add zone transfer clients to the zone. In the Zone Transfer Clients area, select the nameserver object you created.
- Custom DNS profile (optional)
- Modify the DNS profile to allow zone transfers from the BIG-IP system to the client.
Configuring DNS Express to answer DNS queries
DNS Express can answer DNS queries for a DNS zone configured on and transferred to the BIG-IP
system. Optionally, DNS Express can use TSIG keys to validate zone transfer communications
between the BIG-IP system and the authoritative DNS server hosting the zone.
Example of loading a zone into DNS Express
In this figure, an administrator at Site Request creates a DNS zone with a DNS Express server. The name of the DNS zone on the BIG-IP system matches the name of the zone on the authoritative DNS server. The creation of the zone
initiates a zone transfer request from DNS Express to the authoritative DNS server that hosts
the zone. The server responds with a zone transfer and the zone is loaded into the DNS Express
engine.
- Creation of siterequest.com DNS zone with a DNS Express server on the BIG-IP system initiates an unsolicited zone transfer request.
- Authoritative DNS server responds with zone transfer and DNS Express loads the zone.
Example of DNS Express answering DNS queries
In this figure, as the zone is updated, the authoritative DNS server sends a NOTIFY to DNS
Express, which responds with a zone transfer request. The server responds with a zone transfer
and the zone is updated in DNS Express. When the LDNS sends a query for the zone, DNS Express
can answer the query faster than the authoritative DNS server.
- When zone update occurs, DNS server sends NOTIFY message to DNS Express.
- DNS Express sends zone transfer request in response.
- DNS server answers with zone transfer and DNS Express updates the zone.
- LDNS sends DNS query for the zone.
- DNS Express answers with authoritative response. The response is faster than the authoritative DNS server.
About TSIG key authentication
The BIG-IP® system can use transaction signature (TSIG) keys to
authenticate communications about zone transfers between the BIG-IP system and authoritative DNS
servers, and between the BIG-IP system and DNS nameservers (clients). TSIG keys are generated by a third party tool such as BIND's keygen utility. Using
TSIG keys is optional.
- TSIG key configured on authoritative DNS server
- You can add a TSIG key to a nameserver object that represents an authoritative DNS server. With this configuration, when the DNS server sends a NOTIFY message to the BIG-IP system, DNS Express™ responds with a TSIG-signed zone transfer request. Then the DNS server returns a TSIG-signed zone transfer. If required, you can disable theVerify Notify TSIGoption on the DNS zone. With this configuration, DNS Express can process a NOTIFY message without a TSIG key, even when a subsequent zone transfer requires a TSIG key.
- TSIG key configured on DNS nameserver (client)
- You can add a TSIG key to a nameserver object that represents a DNS nameserver (client). When the client sends a TSIG-signed zone transfer request, DNS Express returns a TSIG-signed zone transfer.
- TSIG key configured on DNS zone
- You can add a server TSIG key to a DNS zone on the BIG-IP system. With this configuration, the system uses this TSIG key when the zone on the BIG-IP system is a proxy for the zone on the server. There are two possible scenarios:
- Client sends TSIG-signed zone transfer requestWhen the BIG-IP system receives a TSIG-signed zone transfer request from a client for a DNS zone for which it is a proxy, the system validates the client TSIG key and removes the key from the request. The system then adds the server TSIG key to the request and forwards the TSIG-signed request to the DNS server or load balances the TSIG-signed request to a pool of DNS servers. The DNS server responds with a TSIG-signed zone transfer. The BIG-IP system validates the server TSIG key and removes the key. Then the system adds the client TSIG key and returns a TSIG-signed signed zone transfer to the client.
- Client sends unsigned zone transfer requestWhen the BIG-IP system receives an unsigned zone transfer request from a client for a DNS zone for which it is a proxy, the system adds the server TSIG key to the request. The system then forwards the TSIG-signed request to the DNS server or load balances the TSIG-signed request to a pool of DNS servers. The DNS server responds with a TSIG-signed zone transfer. The BIG-IP system validates the server TSIG key and removes the key. Then the system returns an unsigned zone transfer to the client.
About
listeners
A
listener
is a specialized virtual
server that passively checks for DNS packets on port 53 and the IP address you assign to the
listener. When a DNS request is sent to the IP address of the listener, the BIG-IP system either handles the request or forwards the request to the
appropriate resource. Task summary for configuring DNS Express to answer queries for a zone
Perform these tasks to configure DNS Express® to answer DNS queries for a
DNS zone:
Configuring BIND
servers to allow zone transfers
If you are unfamiliar with how to modify BIND server files, review the fifth edition of
DNS and BIND
, available from O’Reilly
Media.Typically, BIND servers allow zone transfers to
any DNS nameserver requesting a zone transfer. That is,
named.conf
on a typical BIND server does not contain an allow-transfer
statement. However, the BIND server on the BIG-IP system is configured to allow zone
transfers to only the localhost. Thus, named.conf
on the BIG-IP system contains this allow-transfer statement:
allow-transfer { localhost; } ;
.When you want to improve the speed of responses to DNS queries
you can configure a BIND server to allow zone transfers only to the DNS Express
engine on the BIG-IP system. You do this by adding an allow-transfer statement to
named.conf
on the BIND server.
Adding an allow-transfer statement to a BIND server actually
restricts zone transfers to a specified list of DNS nameservers.
- Add to the BIND server an allow-transfer statement that specifies a self IP address on the BIG-IP system.You can modify the following allow-transfer statement to use a self IP address on the BIG-IP system:allow-transfer { localhost; <self IP address from which zone transfer request is sent to the server>; };allow-transfer { localhost; 10.10.10.1 ; };
Configuring local
BIND to send NOTIFY messages to DNS Express
When you configure an allow-transfer statement in
named.conf
on the local BIND server
on the BIG-IP system to allow zone transfers only to DNS Express, you must include an
also-notify
statement that directs
NOTIFY messages from local BIND to DNS Express.- Add tonamed.confon the local BIND, analso-notifystatement that specifies the BIG-IP system use this loopback address and port:::1 port 5353globally.If you prefer, you can configure thealso-notifystatement on a per-zone or per view basis.also-notify { ::1 port 5353; };
Adding TSIG
keys
Obtain
the TSIG key that the DNS servers in the pool that hosts the zone use to authenticate zone
transfer requests. Optionally, obtain the TSIG key for the DNS nameserver (client) that you want
to add to the BIG-IP system configuration.
TSIG keys are created by a
third party tool such as BIND's keygen utility. The configuration of each DNS server in the pool
must contain the same TSIG key.
When you want the BIG-IP system to validate zone transfers from a pool DNS
servers, add the server TSIG key to the BIG-IP system configuration. Optionally, if you want the
BIG-IP system to validate the DNS nameservers (clients) sending zone transfer requests, add the
client TSIG keys.
- On the Main tab, click.The TSIG Key List screen opens.
- ClickCreate.The New TSIG Key screen opens.
- In theNamefield, type the name of the TSIG key.
- From the Algorithm list, select the algorithm that was used to generate the key.
- In theSecretfield, type the TSIG key secret.
- ClickFinished.
- If the DNS nameservers (clients) requesting zone transfers contain a TSIG key, repeat steps 2-7 to add each client TSIG key.
Add
the server TSIG key to a DNS zone configured on the BIG-IP system. Optionally, add TSIG keys to
DNS nameservers (clients) configured on the BIG-IP system.
Adding nameserver
objects that represent DNS servers
Obtain the IP address of the authoritative DNS server that hosts the DNS zone.
Optional: Ensure that the server TSIG key is available on the BIG-IP system.
When you want to transfer a zone from an
authoritative DNS server into the DNS Express engine and have DNS Express respond to DNS
queries for the zone, add a nameserver object that represents the server that hosts the
zone.
- On the Main tab, click.The Nameservers List screen opens.
- ClickCreate.The New Nameserver screen opens.
- In theNamefield, type a name for the authoritative DNS server.
- In theAddressfield, type the IP address on which the DNS server listens for DNS messages.
- Optional: From theServer Keylist, select the TSIG key that matches the TSIG key on the DNS server.The BIG-IP system uses this TSIG key to sign DNS zone transfer requests sent to the DNS server that hosts this zone, and then to verify a zone transfer returned from the DNS server.
Create a DNS zone and add a DNS Express server
object to the zone.
Creating a DNS zone to answer DNS queries
Before you create a DNS zone, you must:
- Ensure that the authoritative DNS server that currently hosts the zone is configured to allow zone transfers to the BIG-IP system.
- Ensure that a nameserver object that represents the authoritative DNS server exists in the BIG-IP system configuration.
- Determine the name you want to use for the zone. The zone name must match the zone name on the authoritative DNS server exactly.Zone names are not case-sensitive.
You create a DNS zone on the BIG-IP system when you want the DNS Express engine to answer DNS queries for
the zone.
- On the Main tab, click.The Zone List screen opens.
- ClickCreate.The New Zone screen opens.
- In theNamefield, type the name of the DNS zone.The name must begin and end with a letter and contain only letters, numbers, and the period and hyphen (-) characters.
- In the DNS Express area, from theServerlist, select the authoritative primary DNS server that currently hosts the zone.The DNS Express engine requests zone transfers from this server.
- From theNotify Actionlist, select one of the options to specify the action the DNS Express engine takes after receiving a NOTIFY message for this zone.ActionDescriptionConsumeNOTIFY messages go to the DNS Express engine. This is the default value.BypassNOTIFY messages do not go to the DNS Express engine, but instead go to a DNS server (subject to DNS profile unhandled-query-action).RepeatNOTIFY messages go to both the DNS Express engine and a DNS server.If the nameserver object for the DNS server is configured with a TSIG Key, the signature is validated only forConsumeandRepeatactions. Additionally, NOTIFY responses are assumed to be sent by the DNS server, except when the action isConsumeand the DNS Express engine generates the response.
- For theAllow NOTIFY Fromsetting, in theAddressfield, type an IP address from which the BIG-IP system will accept NOTIFY messages for the DNS Express zone.The IP address of the authoritative primary DNS Server selected in step 4 is allowed by default, and does not need to be entered.
- ClickFinished.
Disabling TSIG verification for NOTIFY messages
The BIG-IP
system might need to accept a zone transfer for a DNS Express zone
from an authoritative DNS server, even if the NOTIFY message does not contain a TSIG
key. To configure the system for this scenario, you can disable TSIG verification for
NOTIFY messages, as an option.
- On the Main tab, click.The Zone List screen opens.
- Click the name of the zone you want to modify.
- From theDNS Expresslist, selectAdvanced.
- Clear theVerify Notify TSIGcheck box.
- ClickUpdate.
Optional: Enabling DNS Express with a custom DNS profile
The BIG-IP
system contains a default DNS profile on which DNS Express is
enabled. However, you can create a custom DNS profile to work with your network
architecture.
If you
plan to use the BIND server on a BIG-IP DNS system, use the
default
dns
profile. - On the Main tab, clickor .The DNS profile list screen opens.
- ClickCreate.The New DNS Profile screen opens.
- In the General Properties area, name the profiledns_express.
- In the General Properties area, from theParent Profilelist, accept the defaultdnsprofile.
- Select theCustomcheck box.
- In the DNS Features area, from theGSLBlist, selectDisabled.
- In the DNS Features area, from theDNS Expresslist, retain the default valueEnabled.
- In the DNS Features area, from theUnhandled Query Actionslist, select how you want the BIG-IP system to handle a query that is not for a wide IP or DNS Express zone.OptionDescriptionAllowThe BIG-IP system forwards the query to a DNS server or a member of a pool of DNS servers. Note that if the pool is not associated with a listener and theUse BIND Server on BIG-IPoption is set toenabled, queries are forwarded to the local BIND server. (Allow is the default value.)DropThe BIG-IP system does not respond to the query.RejectThe BIG-IP system returns the query with the REFUSED return code.HintThe BIG-IP system returns the query with a list of root name servers.No ErrorThe BIG-IP system returns the query with the NOERROR return code.
- In the DNS Features area, from theUse BIND Server on BIG-IPlist, selectDisabled.
- ClickFinished.
Assign the profile to virtual servers or listeners.
Viewing DNS zone statistics
You can view information about DNS zones.
- On the Main tab, click.The Zones statistics screen opens.
- From theStatistics Typelist, selectZones.Information displays about the traffic handled by the zones in the list.
- In the Details column for a zone, clickView.Read the online help for an explanation of the statistics.
Configuring DNS Express to answer zone transfer requests
DNS Express® can respond to zone transfer requests for a DNS zone from
specified DNS nameservers (clients). Optionally, DNS Express can use TSIG keys to validate the
identity of the client making the zone transfer request.
Example of DNS Express answering zone transfer requests
In this figure, as the zone is updated, the authoritative DNS server sends a NOTIFY to DNS
Express, which responds with a zone transfer request. The server responds with a zone transfer
and the zone is updated in DNS Express. DNS Express sends a NOTIFY to the client, and the
client responds with a zone transfer request for the zone. DNS Express responds with a zone
transfer and the client updates the zone.
- When zone update occurs, the DNS server sends NOTIFY message to DNS Express.
- DNS Express sends zone transfer request as a result of the NOTIFY query.
- DNS server answers with zone transfer and DNS Express updates the zone.
- DNS Express sends NOTIFY to authoritative DNS nameserver client.
- Client sends zone transfer request as a result of the NOTIFY query.
- DNS Express answers with zone transfer of siterequest.com, and client updates the zone.
Task summary to configure BIG-IP system to respond to zone transfer requests
To configure the BIG-IP® system to respond to zone transfer requests, perform
these tasks:
Adding nameserver
objects that represent DNS nameservers (clients)
Gather the IP addresses of the DNS nameservers (clients) from which the DNS Express
engine accepts zone transfer requests for a DNS zone. Optional: Ensure that the client
TSIG key is available on the BIG-IP system.
To allow DNS nameservers (clients) to request zone
transfers for a zone, add a nameserver object that represents each client. Optionally,
you can add a client TSIG key that the BIG-IP system uses to authenticate the identity
of the client during zone transfer communications.
- On the Main tab, click.The Nameservers List screen opens.
- ClickCreate.The New Nameserver screen opens.
- In theNamefield, type a name for the DNS nameserver (client).
- In theAddressfield, type the IP address on which the DNS nameserver (client) listens for DNS messages.
- Optional: From theTSIG Keylist, select the TSIG key you want the BIG-IP system to use to validate zone transfer traffic.
- ClickFinished.
- Add nameserver objects to represent other DNS nameservers (clients).
Add the DNS nameservers (clients) objects to the
Zone Transfer Client
list
of the DNS zone on the BIG-IP system. Configuring DNS
Express to answer zone transfer requests from specified clients
Ensure that nameserver objects exist in the BIG-IP system configuration that represent
the DNS server that hosts the zone and the DNS nameservers (clients) that are permitted
to request zone transfers.
You can configure DNS Express to respond to zone
transfer requests for a specific zone by adding nameservers to the
Zone Transfer Clients
list for the
zone. - On the Main tab, click.The Zone List screen opens.
- Click the name of the zone you want to modify.
- In the Zone Transfer Clients area, move the nameservers that can initiate zone transfers from theAvailablelist to theActivelist.
- ClickFinished.
The nameservers in the
Active
list can initiate zone transfer requests for this zone.Enabling DNS Express to respond to a zone transfer request
DNS zone transfers use TCP port
53
. Ensure that a listener
configured for TCP exists in the configuration.To enable DNS Express to answer zone transfers for a zone, modify the DNS profile
assigned to the listener.
- On the Main tab, clickor .The DNS profile list screen opens.
- In the Name column, click the name of the profile you want to modify.
- Select theCustomcheck box.
- In the DNS Traffic area, from theZone Transferlist, selectEnabled.
- ClickFinished.