You can configure the BIG-IP^® system to use the DNS Express^® engine to answer queries for a DNS zone. This involves a zone transfer from the authoritative DNS server into DNS Express and then DNS Express can answer DNS queries for the zone. For this configuration you create the following objects in the order described.

TSIG key (optional)

Obtain the TSIG key data from the authoritative DNS server that hosts the zone and create a TSIG key object.

Nameserver object

Create a nameserver object to represent the authoritative DNS server. Optionally, add the TSIG key.

DNS zone

Create a zone object and in the DNS Express area, select the nameserver object that represents the authoritative DNS server that hosts the zone.

Custom DNS profile (optional)

Create a custom DNS profile based on your network architecture.

DNS listener or LTM virtual server

Create a DNS listener or LTM virtual server and select a DNS profile. You can use either the default DNS profile or the custom DNS profile.

Additionally, you can configure the BIG-IP system to use the DNS Express engine to answer zone transfer requests for a DNS zone from a DNS nameserver that answers DNS queries. For this configuration you create or modify the following objects in the order described.

TSIG key (optional)

Obtain the TSIG key data from the DNS nameserver client that you want to allow to send zone transfer requests for the DNS zone and create a TSIG key object.

Nameserver object

Create a nameserver object to represent the DNS nameserver that will make the zone transfer request. Optionally, add the TSIG key.

DNS zone

Modify the zone object to add zone transfer clients to the zone. In the Zone Transfer Clients area, select the nameserver object you created.

Custom DNS profile (optional)

Modify the DNS profile to allow zone transfers from the BIG-IP system to the client.

In this figure, an administrator at Site Request creates a DNS zone with a DNS Express™ server. The name of the DNS zone on the BIG-IP^® system matches the name of the zone on the authoritative DNS server. The creation of the zone initiates a zone transfer request from DNS Express to the authoritative DNS server that hosts the zone. The server responds with a zone transfer and the zone is loaded into the DNS Express engine.

DNS zone transfer to DNS Express

1. Creation of siterequest.com DNS zone with a DNS Express server on the BIG-IP system initiates an unsolicited zone transfer request.
2. Authoritative DNS server responds with zone transfer and DNS Express loads the zone.

In this figure, as the zone is updated, the authoritative DNS server sends a NOTIFY to DNS Express, which responds with a zone transfer request. The server responds with a zone transfer and the zone is updated in DNS Express. When the LDNS sends a query for the zone, DNS Express can answer the query faster than the authoritative DNS server.

DNS Express answering queries for a DNS zone

1. When zone update occurs, DNS server sends NOTIFY message to DNS Express.
2. DNS Express sends zone transfer request in response.
3. DNS server answers with zone transfer and DNS Express updates the zone.
4. LDNS sends DNS query for the zone.
5. DNS Express answers with authoritative response. The response is faster than the authoritative DNS server.

The BIG-IP^® system can use transaction signature (TSIG) keys to authenticate communications about zone transfers between the BIG-IP system and authoritative DNS servers, and between the BIG-IP system and DNS nameservers (clients). TSIG keys are generated by a third party tool such as BIND's keygen utility. Using TSIG keys is optional.

TSIG key configured on authoritative DNS server

You can add a TSIG key to a nameserver object that represents an authoritative DNS server. With this configuration, when the DNS server sends a NOTIFY message to the BIG-IP system, DNS Express™ responds with a TSIG-signed zone transfer request. Then the DNS server returns a TSIG-signed zone transfer. If required, you can disable the Verify Notify TSIG option on the DNS zone. With this configuration, DNS Express can process a NOTIFY message without a TSIG key, even when a subsequent zone transfer requires a TSIG key.

TSIG key configured on DNS nameserver (client)

You can add a TSIG key to a nameserver object that represents a DNS nameserver (client). When the client sends a TSIG-signed zone transfer request, DNS Express returns a TSIG-signed zone transfer.

TSIG key configured on DNS zone

You can add a server TSIG key to a DNS zone on the BIG-IP system. With this configuration, the system uses this TSIG key when the zone on the BIG-IP system is a proxy for the zone on the server. There are two possible scenarios:

• Client sends TSIG-signed zone transfer request

  When the BIG-IP system receives a TSIG-signed zone transfer request from a client for a DNS zone for which it is a proxy, the system validates the client TSIG key and removes the key from the request. The system then adds the server TSIG key to the request and forwards the TSIG-signed request to the DNS server or load balances the TSIG-signed request to a pool of DNS servers. The DNS server responds with a TSIG-signed zone transfer. The BIG-IP system validates the server TSIG key and removes the key. Then the system adds the client TSIG key and returns a TSIG-signed signed zone transfer to the client.

• Client sends unsigned zone transfer request

  When the BIG-IP system receives an unsigned zone transfer request from a client for a DNS zone for which it is a proxy, the system adds the server TSIG key to the request. The system then forwards the TSIG-signed request to the DNS server or load balances the TSIG-signed request to a pool of DNS servers. The DNS server responds with a TSIG-signed zone transfer. The BIG-IP system validates the server TSIG key and removes the key. Then the system returns an unsigned zone transfer to the client.

A listener is a specialized virtual server that passively checks for DNS packets on port 53 and the IP address you assign to the listener. When a DNS request is sent to the IP address of the listener, the BIG-IP^® system either handles the request or forwards the request to the appropriate resource.

1. On the Main tab, click DNS > Delivery > Keys > TSIG Key List .
   The TSIG Key List screen opens.
2. Click Create.
   The New TSIG Key screen opens.
3. In the Name field, type the name of the TSIG key.
4. From the Algorithm list, select the algorithm that was used to generate the key.
5. In the Secret field, type the TSIG key secret.
6. Click Finished.
7. Create additional TSIG keys on the BIG-IP system for each DNS server and each client that require authentication of communications.

1. On the Main tab, click DNS > Delivery > Nameservers .
   The Nameservers List screen opens.
2. Click Create.
   The New Nameserver screen opens.
3. In the Name field, type a name for the authoritative DNS server.
4. In the Address field, type the IP address on which the DNS server listens for DNS messages.
5. Optional: From the Server Key list, select the TSIG key that matches the TSIG key on the DNS server.
   The BIG-IP system uses this TSIG key to sign DNS zone transfer requests sent to the DNS server that hosts this zone, and then to verify a zone transfer returned from the DNS server.

1. On the Main tab, click DNS > Zones .
   The Zone List screen opens.
2. Click Create.
   The New Zone screen opens.
3. In the Name field, type the name of the DNS zone.
   The name must begin and end with a letter and contain only letters, numbers, and the period and hyphen (-) characters.
4. In the DNS Express area, from the Server list, select the authoritative primary DNS server that currently hosts the zone.
   Note: The DNS Express engine requests zone transfers from this server.
5. From the Notify Action list, select one of the options to specify the action the DNS Express engine takes after receiving a NOTIFY message for this zone.

   Action	Description
   Consume	NOTIFY messages go to the DNS Express engine. This is the default value.
   Bypass	NOTIFY messages do not go to the DNS Express engine, but instead go to a DNS server (subject to DNS profile unhandled-query-action).
   Repeat	NOTIFY messages go to both the DNS Express engine and a DNS server.

   Tip: If the nameserver object for the DNS server is configured with a TSIG Key, the signature is validated only for Consume and Repeat actions. Additionally, NOTIFY responses are assumed to be sent by the DNS server, except when the action is Consume and the DNS Express engine generates the response.
6. For the Allow NOTIFY From setting, in the Address field, type an IP address from which the BIG-IP system will accept NOTIFY messages for the DNS Express zone.
   Note: The IP address of the authoritative primary DNS Server selected in step 4 is allowed by default, and does not need to be entered.
7. Click Finished.

1. On the Main tab, click DNS > Zones .
   The Zone List screen opens.
2. Click the name of the zone you want to modify.
3. From the DNS Express list, select Advanced.
4. Clear the Verify Notify TSIG check box.
5. Click Update.

1. On the Main tab, click DNS > Delivery > Profiles > DNS or Local Traffic > Profiles > Services > DNS .
   The DNS profile list screen opens.
2. Click Create.
   The New DNS Profile screen opens.
3. In the General Properties area, name the profile dns_express.
4. In the General Properties area, from the Parent Profile list, accept the default dns profile.
5. Select the Custom check box.
6. In the DNS Features area, from the GSLB list, select Disabled.
7. In the DNS Features area, from the DNS Express list, retain the default value Enabled.
8. In the DNS Features area, from the Unhandled Query Actions list, select how you want the BIG-IP system to handle a query that is not for a wide IP or DNS Express zone.

   Option	Description
   Allow	The BIG-IP system forwards the query to a DNS server or a member of a pool of DNS servers. Note that if the pool is not associated with a listener and the Use BIND Server on BIG-IP option is set to enabled, queries are forwarded to the local BIND server. (Allow is the default value.)
   Drop	The BIG-IP system does not respond to the query.
   Reject	The BIG-IP system returns the query with the REFUSED return code.
   Hint	The BIG-IP system returns the query with a list of root name servers.
   No Error	The BIG-IP system returns the query with the NOERROR return code.

9. In the DNS Features area, from the Use BIND Server on BIG-IP list, select Disabled.
10. Click Finished.

1. On the Main tab, click DNS > Delivery > Listeners .
   The Listeners List screen opens.
2. Click Create.
   The Listeners properties screen opens.
3. In the Name field, type a unique name for the listener.
4. For the Destination setting, in the Address field, type an IPv4 address on which the BIG-IP system listens for DNS queries.
5. From the Listener list, select Advanced.
6. Optional: If you are using SNATs on your network, from the Source Address Translation list, select SNAT.
7. Optional: If you are using NATs on your network, for the Address Translation setting, select the Enabled check box.
8. Optional: If you are using port translation on your network, for the Port Translation setting, select the Enabled check box.
9. In the Service area, from the Protocol list, select UDP.
10. In the Service area, from the DNS Profile list, select either dns or a custom DNS profile configured for DNS Express.
11. Click Finished.

1. On the Main tab, click Statistics > Module Statistics > DNS > Zones .
   The Zones statistics screen opens.
2. From the Statistics Type list, select Zones.
   Information displays about the traffic handled by the zones in the list.
3. In the Details column for a zone, click View.
   Read the online help for an explanation of the statistics.

In this figure, as the zone is updated, the authoritative DNS server sends a NOTIFY to DNS Express, which responds with a zone transfer request. The server responds with a zone transfer and the zone is updated in DNS Express. DNS Express sends a NOTIFY to the client, and the client responds with a zone transfer request for the zone. DNS Express responds with a zone transfer and the client updates the zone.

DNS Express answering zone transfer requests for DNS zone

1. When zone update occurs, the DNS server sends NOTIFY message to DNS Express.
2. DNS Express sends zone transfer request as a result of the NOTIFY query.
3. DNS server answers with zone transfer and DNS Express updates the zone.
4. DNS Express sends NOTIFY to authoritative DNS nameserver client.
5. Client sends zone transfer request as a result of the NOTIFY query.
6. DNS Express answers with zone transfer of siterequest.com, and client updates the zone.

1. On the Main tab, click DNS > Delivery > Nameservers .
   The Nameservers List screen opens.
2. Click Create.
   The New Nameserver screen opens.
3. In the Name field, type a name for the DNS nameserver (client).
4. In the Address field, type the IP address on which the DNS nameserver (client) listens for DNS messages.
5. Optional: From the TSIG Key list, select the TSIG key you want the BIG-IP system to use to validate zone transfer traffic.
6. Click Finished.
7. Add nameserver objects to represent other DNS nameservers (clients).

1. On the Main tab, click DNS > Zones .
   The Zone List screen opens.
2. Click the name of the zone you want to modify.
3. In the Zone Transfer Clients area, move the nameservers that can initiate zone transfers from the Available list to the Active list.
4. Click Finished.

1. On the Main tab, click DNS > Delivery > Profiles > DNS or Local Traffic > Profiles > Services > DNS .
   The DNS profile list screen opens.
2. In the Name column, click the name of the profile you want to modify.
3. Select the Custom check box.
4. In the DNS Traffic area, from the Zone Transfer list, select Enabled.
5. Click Finished.