Applies To:
Show Versions
BIG-IP GTM
- 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1
BIG-IP LTM
- 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1
Configuring a DNS Zone Proxy
Overview: Configuring a DNS zone proxy
Within your network, the BIG-IP® system can act as a proxy for an authoritative DNS server. In this case, when the BIG-IP system receives a zone transfer request from a specified list of DNS namservers (clients), the system sends the request to the authoritative DNS server. The server responds with a zone transfer, and the BIG-IP system sends the zone transfer to the client that made the zone transfer request. Optionally, the BIG-IP system can use transaction signature (TSIG) keys to validate the identity of the authoritative DNS server sending a zone transfer and the DNS nameservers (clients) sending zone transfer requests.
Example of DNS zone proxy with client-side TSIG authentication
In this figure, an administrator at Site Request creates a DNS zone on the BIG-IP system that is a proxy for the zone on the authoritative DNS server that hosts the zone. The name of the DNS zone on the BIG-IP system matches the name of the zone on the authoritative DNS server. The administrator uses TSIG key authenthication to verify the zone transfer communications between the BIG-IP system and the DNS nameserver (client) making the zone transfer request.

BIG-IP system acting as DNS zone proxy with client-side TSIG authentication
- DNS nameserver (client) sends TSIG-signed zone transfer request for a DNS zone.
- BIG-IP system validates the signature and removes the client TSIG key.
- BIG-IP system sends the unsigned request to the DNS server that hosts the zone.
- DNS server answers with an unsigned zone transfer to the BIG-IP system.
- BIG-IP system adds the client TSIG key to the response.
- BIG-IP system sends a TSIG-signed zone transfer to the DNS nameserver that made the request.
Example of DNS zone proxy with client-side and server-side TSIG authentication
In this figure, an administrator at Site Request creates a DNS zone on the BIG-IP system that is a proxy for the zone on the authoritative DNS server that hosts the zone. The name of the DNS zone on the BIG-IP system matches the name of the zone on the authoritative DNS server. The administrator uses TSIG key authenthication to verify the zone transfer communications between the BIG-IP system and the authoritative DNS server and between the BIG-IP system and the client making a zone transfer request.

BIG-IP system acting as DNS zone proxy with client and server-side TSIG authentication
- DNS nameserver (client) sends TSIG-signed zone transfer request for a DNS zone.
- BIG-IP system validates the signature, removes the client TSIG key from the request, and adds the server TSIG key to the request.
- BIG-IP system sends the TSIG-signed request to the DNS server that hosts the zone.
- DNS server answers with a TSIG-signed zone transfer to the BIG-IP system.
- BIG-IP system validates the signature, removes the server TSIG key from the response, and adds the client TSIG key to the response.
- BIG-IP system sends the TSIG-signed zone transfer to the DNS nameserver that made the request.
About TSIG key authentication
The BIG-IP® system can use transaction signature (TSIG) keys to authenticate communications about zone transfers between the BIG-IP system and authoritative DNS servers, and between the BIG-IP system and DNS nameservers (clients). TSIG keys are generated by a third party tool such as BIND's keygen utility. Using TSIG keys is optional.
- TSIG key configured on authoritative DNS server
- You can add a TSIG key to a nameserver object that represents an authoritative DNS server. With this configuration, when the DNS server sends a NOTIFY message to the BIG-IP system, DNS Express™ responds with a TSIG-signed zone transfer request. Then the DNS server returns a TSIG-signed zone transfer. If required, you can disable the Verify Notify TSIG option on the DNS zone. With this configuration, DNS Express can process a NOTIFY message without a TSIG key, even when a subsequent zone transfer requires a TSIG key.
- TSIG key configured on DNS nameserver (client)
- You can add a TSIG key to a nameserver object that represents a DNS nameserver (client). When the client sends a TSIG-signed zone transfer request, DNS Express returns a TSIG-signed zone transfer.
- TSIG key configured on DNS zone
- You can add a server TSIG key to a DNS zone on the BIG-IP system. With this configuration,
the system uses this TSIG key when the zone on the BIG-IP system is a proxy for the zone on the
server. There are two possible scenarios:
- Client sends TSIG-signed zone transfer request
When the BIG-IP system receives a TSIG-signed zone transfer request from a client for a DNS zone for which it is a proxy, the system validates the client TSIG key and removes the key from the request. The system then adds the server TSIG key to the request and forwards the TSIG-signed request to the DNS server or load balances the TSIG-signed request to a pool of DNS servers. The DNS server responds with a TSIG-signed zone transfer. The BIG-IP system validates the server TSIG key and removes the key. Then the system adds the client TSIG key and returns a TSIG-signed signed zone transfer to the client.
- Client sends unsigned zone transfer request
When the BIG-IP system receives an unsigned zone transfer request from a client for a DNS zone for which it is a proxy, the system adds the server TSIG key to the request. The system then forwards the TSIG-signed request to the DNS server or load balances the TSIG-signed request to a pool of DNS servers. The DNS server responds with a TSIG-signed zone transfer. The BIG-IP system validates the server TSIG key and removes the key. Then the system returns an unsigned zone transfer to the client.
- Client sends TSIG-signed zone transfer request
About listeners
A listener is a specialized virtual server that passively checks for DNS packets on port 53 and the IP address you assign to the listener. When a DNS request is sent to the IP address of the listener, the BIG-IP® system either handles the request or forwards the request to the appropriate resource.
Task summary
Perform these tasks to configure a DNS zone on the BIG-IP system that is a proxy for a DNS zone on a DNS server in your network:
Configuring BIND servers to allow zone transfers
When you want the BIG-IP® system to act as a proxy for a DNS zone configured on a BIND server, you must add an allow-transfer statement to named.conf on the BIND server that hosts the zone.
allow-transfer { localhost; 10.10.10.1 ; };
Adding TSIG keys for DNS zone proxy
When you want the BIG-IP system to authenticate the identity of the DNS server and DNS nameservers (clients) when communicating about DNS zone transfers, add TSIG keys to the BIG-IP system configuration.
Adding DNS nameserver (client) objects
Enabling zone transfers
Creating a DNS zone
- Optional: Ensure that the TSIG key on the DNS server is available on the BIG-IP system.
- Determine the name you want to use for the DNS zone. The name must exactly match the name on
the DNS server that hosts the zone. Note: Zone names are case insensitive.
Creating listeners to forward zone transfer requests
Create listeners to alert the BIG-IP® system to zone transfer requests destined for a DNS server that hosts the zone. Create two listeners that use the TCP protocol, one each for an IPv4 address and IPv6 address.
Creating virtual servers to forward zone transfer requests
Create virtual servers to alert the BIG-IP system to zone transfer requests destined for a DNS server that hosts the zone. Create two virtual servers that use the TCP protocol, one each for an IPv4 address and IPv6 address.