You control how BIG-IP GTM responds to DNS queries on a per-listener basis. The number of listeners you create depends on your network configuration and the destinations to which you want to send specific queries. For example, a single BIG-IP GTM can be the primary authoritative server for one domain, while forwarding other DNSqueries to a different DNS server. BIG-IP GTM always manages and responds to DNS queries for the wide IPs that are configured on the system.

Consider the fictional company SiteRequest, once integrated into the network, BIG-IP GTM is responsible for:

• Managing and responding to requests for two wide IPs configured on the external VLAN:
  • www.siterequest.com
  • downloads.siterequest.com
• Forwarding DNS traffic destined for a DNS server at IP address 10.2.5.37

In this scenario, BIG-IP GTM requires two listeners:

• A listener with an IP address that is on an external VLAN to manage DNS traffic destined for the wide IPs.
• A listener with the IP address of the local DNS server 10.2.5.37 to which the system can forward incoming traffic destined for that server.

Listener configuration example

A wildcard listener is a special listener that is assigned an IP address of 0.0.0.0 and the DNS query port (port 53). When you want BIG-IP GTM to respond to DNS queries coming into your network, regardless of the destination IP address of the given request, you use a wildcard listener.

You can view the number of successful and failed probe requests that the BIG-IP GTM system (on which you are viewing statistics) made to the Prober pools. These statistics reflect only the number of Probe requests and their success or failure. These statistics do not reflect the actual probes that the pool members made to servers on your network.

Prober pool statistics are not aggregated among the BIG-IP GTM systems in a synchronization group. The statistics on one BIG-IP GTM include only the requests made from that BIG-IP GTM system.

In this figure, the Prober pool statistics that display on BIG-IP GTM1 are the probe requests made only by that system.

Prober pool statistics displayed per system

The status of a Prober pool also indicates the status of the members of the pool. If at least one member of a Prober pool has green status (Available), the Prober pool has green status.

The status of a Prober pool member indicates whether the BIG-IP GTM system, on which you are viewing status, can establish an iQuery connection with the member.

BIG-IP Global Traffic Manager (GTM) is responsible for acquiring data from local DNS servers (LDNS) using probes. Unlike probes conducted on internal systems, such as web servers, probes of an LDNS require that BIG-IP GTM verifies data from a resource that exists outside the network. Typically, this data is the path information BIG-IP GTM requires when conducting Quality of Service, Round Trip Time, Completion Rate, and Hops load balancing methods.

Flow of probe process

In version 10.2 of BIG-IP Global Traffic Manager (GTM), you could assign a single BIG-IP system to probe a server to gather health and performance data. You did this by specifying the IP address of the BIG-IP system (which you chose to perform probes of the server) in the Statistics Collection Server field of the server. In version 11.0, this feature was replaced by the Prober pool feature.

When you upgrade from version 10.2.x to version 11.x, if a single BIG-IP system was assigned to probe a server, BIG-IP GTM converts the single server to a Prober pool with one member, and then assigns the Prober pool to the server to which the Statistics Collection server was originally assigned. The name of the new Prober pool is based on the IP address of the original Statistics Collection server. If the original Statistics Collection server had an IP address of 10.10.2.3, the name of the automatically created Prober pool is prober_pool_10_10_2_3.

By default, BIG-IP GTM delegates the probe of a resource to a BIG-IP GTM that is in the same data center as the resource, because the close proximity improves probe response time. However, when more than one BIG-IP GTM in a GTM synchronization group resides in the same data center, an algorithm is used to delegate the probes of resources equally among those BIG-IP GTM systems. This ensures that no BIG-IP GTM becomes overloaded with conducting probes, which can cause a decrease in the performance of the other tasks for which the BIG-IP system is responsible. When a data center does not contain a BIG-IP GTM, an algorithm is used to distribute the actual probes of a resource in that data center equally among the BIG-IP GTM systems in the synchronization group.

An LDNS entry can be in one of three states: New, Pending, or Active. In general, the New and Pending states are temporary. An LDNS entry remains in one of these states only until the LDNS responds to the first probe request from a BIG-IP GTM.

New

This LDNS has not contacted BIG-IP GTM before.

Pending

This LDNS has contacted BIG-IP GTM before; however, this LDNS has yet to respond to a probe.

Active

BIG-IP GTM has an entry for this LDNS.

This table describes the protocols and ports the big3d agent uses to communicate with an LDNS when collecting path data for the local DNS servers.

BIG-IP Global Traffic Manager (GTM) supports these wildcard characters in wide IP names and aliases:

Question mark (?)

Use to replace a single character, except a dot (.).

Asterisk (*)

Use to replace multiple consecutive characters with the exception of dots (.)

You can use one or more question marks or asterisks, or both question marks and asterisks in a wide IP name or alias.

Most load balancing methods divide DNS name resolution requests among available pools or virtual servers. Each time BIG-IP GTM receives a request, it sends that request to the most appropriate resource based on the configuration of your network.

For example, when a user visits a web site, multiple DNS name resolution requests are generated as the user moves from page to page. Depending on the load balancing method configured, BIG-IP GTM sends each request to a different server, virtual server, or data center. In certain circumstances, you might want to ensure that a user remains with a given set of resources throughout the session. For example, a user attempting to conduct on online banking transaction needs to remain with the same set of resources to ensure that the transaction is completed successfully.

BIG-IP Global Traffic Manager (GTM) considers any pool associated with a wide IP as a potential resource to which to load balance DNS name resolution requests. A last resort pool is a pool of virtual servers to which BIG-IP GTM sends DNS name resolution requests in the event that all other pools associated with the wide IP are unavailable. When you design your network, ensure that this particular pool is kept in reserve and not used as part of the normal global server load balancing.

A host is a network resource that is not a part of the BIG-IP product family and does not provide load balancing. BIG-IP Global Traffic Manager (GTM) supports these host servers:

• CacheFlow
• NetApp
• Sun Solaris
• Windows 2000 Server (You can monitor the Windows Vista Enterprise Server using the Windows 2000 Server.)
• Windows NT 4.0

BIG-IP Global Traffic Manager (GTM) interacts with other load balancing servers to determine availability and assess performance when responding to DNS name resolution requests. BIG-IP GTM supports these load balancing servers:

• Alteon Ace Director
• Cisco CSS
• Cisco LocalDirector v2
• Cisco LocadDirector v3
• Cisco SLB
• Extreme
• Foundry ServerIron
• Radware WSD
• Other generic load balancers

A virtual server is a specific IP address and port number that points to a resource on the network. In the case of host servers, this IP address and port number likely point to the resource itself. With load balancing systems, virtual servers are often proxies that allow the load balancing server to manage a resource request across a multitude of resources.

A CNAME record specifies that a domain name is an alias of another domain. When you create a pool with a canonical name, BIG-IP Global Traffic Manager(GTM) responds to DNS name resolution requests for the CNAME with the real fully qualified domain name (FQDN).

1. On the Main tab, click DNS > GSLB > Links.. The Links list screen opens.
2. Click Create. The New Link screen opens.
3. Type a name for the link.
   Important: Link names are limited to 63 characters.
4. Specify whether the link uses address translation when communicating between the network and the Internet.
   Important: If you enable this setting, the BIG-IP Link monitor cannot monitor outbound traffic through this link.
5. Type the IP address of a router in the Address field, and then click Add. You can add more than one IP address, depending on how the server on which you are creating the link interacts with the rest of your network.
6. Select the data center where the router that the link represents resides.
7. In the Uplink Address field, specify the IP address of the router on the ISP side of the link. When you configure an uplink address, the BIG-IP system sends SNMP requests to the IP addresses configured in the Router Address List. The system uses the statistics that the router returns to distinguish between internal-only traffic and traffic destined for the Internet.
8. Assign the BIG-IP Link monitor to the link by moving it from the Available list to the Selected list.
9. Click Create.

1. On the Main tab, click DNS > GSLB > Links.. The Links list screen opens.
2. Click Create. The New Link screen opens.
3. Type a name for the link.
   Important: Link names are limited to 63 characters.
4. Specify whether the link uses address translation when communicating between the network and the Internet.
   Important: If you enable this setting, the BIG-IP Link monitor cannot monitor outbound traffic through this link.
5. Type the IP address of a router in the Address field, and then click Add. You can add more than one IP address, depending on how the server on which you are creating the link interacts with the rest of your network.
6. Select the data center where the router that the link represents resides.
7. In the Uplink Address field, specify the IP address of the router on the ISP side of the link. When you configure an uplink address, the BIG-IP system sends SNMP requests to the IP addresses configured in the Router Address List. The system uses the statistics that the router returns to distinguish between internal-only traffic and traffic destined for the Internet.
8. From the Configuration list, select Advanced. Additional controls display on the screen.
9. Assign the BIG-IP Link monitor to the link by moving it from the Available list to the Selected list.
10. From the Weighting list, select Ratio, when you want BIG-IP to continuously check the performance of each link and route outbound traffic through the link with the best performance data.
11. From the Weighting list, select the methodology BIG-IP uses to select a link through which to route outbound traffic.

    Option	Description
    Ratio	Specifies that BIG-IP uses the ratio you specify in the Link Ratio field when selecting a link.
    Price (Dynamic Ratio)	Specifies that the system uses dynamic ratio methodology when selecting the link.

12. If you selected Ratio from the Weighting list, in the Link Ratio field, type the frequency at which the system sends traffic through the link.
13. Click Create.

1. On the Main tab, click DNS > GSLB > Links.. The Links list screen opens.
2. Click Create. The New Link screen opens.
3. Type a name for the link.
   Important: Link names are limited to 63 characters.
4. Specify whether the link uses address translation when communicating between the network and the Internet.
   Important: If you enable this setting, the BIG-IP Link monitor cannot monitor outbound traffic through this link.
5. Type the IP address of a router in the Address field, and then click Add. You can add more than one IP address, depending on how the server on which you are creating the link interacts with the rest of your network.
6. Select the data center where the router that the link represents resides.
7. In the Uplink Address field, specify the IP address of the router on the ISP side of the link. When you configure an uplink address, the BIG-IP system sends SNMP requests to the IP addresses configured in the Router Address List. The system uses the statistics that the router returns to distinguish between internal-only traffic and traffic destined for the Internet.
8. From the Configuration list, select Advanced. Additional controls display on the screen.
9. Assign the BIG-IP Link monitor to the link by moving it from the Available list to the Selected list.
10. From the Weighting list, select Price, when you want BIG-IP to direct outbound traffic through the link with the lowest cost first.
11. Click Create.

1. On the Main tab, click DNS > GSLB > Links.. The Links list screen opens.
2. Click a link name. The Links list screen opens.
3. From the Configuration list, select Advanced. Additional controls display on the screen.
4. Select the Duplex Billing check box when the ISP that provides the link bills for bandwidth usage based on a maximum amount of inbound or outbound traffic (whichever is higher), rather than billing for bandwidth usage based on the total inbound and outbound traffic.
5. Click Create. The Link List screen displays.

named.conf contains the primary operational characteristics of BIND, including DNS views, access control list definitions, and zones. The ZoneRunner utility updates named.conf when you modify the local BIND instance.

1. On the Main tab, click DNS > Zones > ZoneRunner > Zone List. The Zone List screen opens.
2. Click Create. The New Zone screen opens.
3. From the View Name list, select external. The external view is a default view to which you can assign zones.
4. In the Zone Name field, type a period character (.).
5. From the Zone Type list, select Master.
6. Clear the Zone File Name field, and type the zone file name. db.external.siterequest.com
   Note: Do not include a trailing dot.
7. In the Records Creation area, type the values for the SOA and NS record parameters.
8. Click Finished.

1. On the Main tab, click DNS > Zones > ZoneRunner > Zone List. The Zone List screen opens.
2. Click Create. The New Zone screen opens.
3. From the View Name list, select external. The external view is a default view to which you can assign zones.
4. In the Zone Name field, type a period character (.).
5. From the Zone Type list, select Hint.
6. Clear the Zone File Name field, and type the zone file name. db.external.siterequest.com
   Note: Do not include a trailing dot.
7. Click Finished.

1. On the Main tab, click DNS > Zones > ZoneRunner > named Configuration. The named Configuration screen opens.
2. In the Options field, modify the allow-transfer statement to include the IP address of the GTM. You can modify the following allow-transfer statement to use the IP address of the GTM. allow-transfer { localhost; 192.168.10.105; };
3. On the menu bar, click View List. The View List screen opens.
4. Click the name of the view that contains the zone you are configuring. The View Configuration screen opens.
5. In the Options area, modify the match-clients statement based on your configuration.

   View configuration type	Add to match-clients statement
   Single view configuration	view "external" { match-clients { "zrd-acl-000-000"; any; };
   Multiple view configuration, where you want to allow transfers from GTM	Modify the following match-clients statement to use the IP address of the GTM. acl "internal-acl" { <IP address> ; }; view "internal" { match-clients { "zrd-acl-000-001"; "internal-acl"; <IP address> ; }; view "external" { match-clients { "zrd-acl-000-000"; any; };

6. Click Update.

A DNS view is a modification of a nameserver configuration based on the community attempting to access it. Using views, you can build multiple nameserver configurations on the same server, and have those configurations apply dynamically when the request originates from a specified source.

If your DNS handles requests from both inside and outside your company, you can create two views: internal and external.

This table describes the types of DNS zone files.

This table describes the types of DNS resource records that ZoneRunner supports.

BIG-IP Global Traffic Manager (GTM) uses two types of DNSSEC keys to return DNSSEC-compliant responses: a zone-signing key to sign all of the records in a DNSSEC resource record set, and a key-signing key to sign only the DNSKEY record (that is the zone-signing key) of a DNSSEC record set.

To enhance DNSSEC key security, when automatic key management is configured, BIG-IP Global Traffic Manager (GTM) uses an automatic key rollover process that uses overlapping generations of a key to ensure that BIG-IP GTM can always respond to queries with DNSSEC-compliant responses. BIG-IP GTM dynamically creates new generations of each key based on the values of the Rollover Period and Expiration Period of the key.

The first generation of a key has an ID of 0 (zero). Each time BIG-IP GTM dynamically creates a new generation of a key, the ID increments by one. Over time, each generation of a key overlaps the previous generation of the key ensuring that GTM can respond to a DNSSEC query even if one generation of a key becomes unavailable. When a generation of a key expires, BIG-IP GTM automatically removes that generation of the key from the configuration. The value of the TTL (time-to-live) of a key specifies how long a client resolver can cache the key.

Overlapping generations of a key

1. On the Main tab, click DNS > Zones > ZoneRunner > Resource Record List. The Resource Record List screen opens.
2. From the View Name list, select the name of the view that contains the resource records you want to view.
3. From the Zone Name list, select the zone for which you want to view resource records.
4. From the Type list, select the type of resource records you want to view.
5. Click Search.