Forum Discussion

Philip_Bray_719's avatar
Philip_Bray_719
Icon for Nimbostratus rankNimbostratus
Jul 02, 2014

iRule Possibilities for LDNS from a client workstation

Hi,

 

We are implementing F5 GTMs in several data centers globally and need to implement topology based load balancing based on the initiating LDNS source. All the obvious methods i.e authoritative screening etc work fine.However a couple of staff members are proving difficult to convince and management have asked us to investigate using iRules to try and get around the problem. We could deploy DNS servers in each local office to conditionally forward all DNS requests for zones to either the GTMs or the current data center DNS infrastructure we have tested this and this will keep the two people with concerns happy and fix the problem but are trying to keep the changes to current DNS to a minimum.

 

The scenario is as follows.

 

A data center hosts regional DNS servers A Satellite office has no DNS servers but has some data center resources requiring GTM topology load balancing.

 

In this scenario using the GTMs as DNS screening servers works as advertised.

 

What is required to be tested.

 

Current DNS servers forward another top level name space which is hosted on the GTM in the data center. All clients in the region use the current DNS servers which are seen by the GTM as the LDNS source.

 

With the above in Mind is there any way we could use an iRule to inspect the client traffic as the LDNS source and and NOT the Data Center DNS Server ( bearing in mind the GTM delegated name space will sit behind the current DNS servers. )

 

Thanks in advance

 

Philip

 

application delivery
BIG-IP DNS
design
devops
iRules

1 Reply

Sort By
  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Jul 03, 2014

    Hi Philip, Unfortunately if the GTM sees the current DNS servers as the LDNS source so will the iRule on it. DNS doesn't carry special information regarding the client who requested so you can't pick that up within iRule either. However, you may be able to accomplish this by asking to turn off recursive for a specific domains. I do remember that with Windows DNS it's a global settings so it's basically an ON or OFF switch accross the board. However, I do remember that you can do this in BIND.

     

    I hope this helps,

     

    -=Bhattman=-