Forum Discussion

Son_of_Tom_1379's avatar
Son_of_Tom_1379
Icon for Nimbostratus rankNimbostratus
Jun 29, 2015

Changing ZoneRunner NOTIFY Source Address

Hi There,

 

I'm attempting to setup an external name server as a secondary slave, and cannot see how to change the source address when the zone sends it's NOTIFY to the secondary server from a SelfIP to a SNAT address..

 

This system is running 11.6 HF4 with LTM and GTM, although we're only using GTM so serve zones using the Zonerunner at the moment.

 

The virtual servers for both UDP and TCP are using SNAT addresses, but the SelfIP of the F5 is always used for NOTIFYs. I've tried using an iRule to force a SNAT IP when the NOTIFY opcode is seen in the DNS header, however the opcode is never notify. I've used another iRule to binary scan the UDP contents to confirm this so I'm not sure how the transfers work at all (when setup in a lab). Perhaps the iRule is not dumping locally generated traffic, and the NOTIFY is generated locally/not via the virtual server.

 

I've also verified that via TCP dump that notify is seen in the packet.

 

We need to force the use of the SNAT address so the secondary server can allow the transfer, as the secondary server is an external vendor and won't allow us to add more than one IP address.

 

I've been told that the NOTIFY opcode is not used, and the type will always be a query. I don't think this is correct based on section 3.1 of RFC1996 but perhaps I'm failing to read.

 

Hoping somebody can shed some light on this.

 

Thank you.

 

application delivery
BIG-IP DNS
LTM

3 Replies

Sort By
  • antonioc74_2977's avatar
    antonioc74_2977
    Icon for Nimbostratus rankNimbostratus
    Jul 25, 2017

    I saw this post and tried using the notify-source parameter in the named.conf, but that didn't work. Has anyone managed to find a solution?

     

  • DM706_346160's avatar
    DM706_346160
    Icon for Altostratus rankAltostratus
    Feb 07, 2019

    Hey guys/gals, I know this post is very old... but

     

    I'm having a very similar problem. My ISP provider will not process NOTIFY on one address and perform a zone transfer to another IP.

     

    My specific problem is caused by the egress path used for the NOTIFY is different than the ingress path for the DNS servers. I think this is because NOTIFY messages use Common partition egress and for external DNS listeners I've placed them in an /EXT/ partition. F5 is behind an ASA with NAT to those /EXT/ listeners.

     

    I've been told by a few F5 experts to leave the BIND implementation alone, e.g. don't manually modify its files. Further, antonioc states it doesn't work to add notify-source to the named.conf.

     

    Which means my only option is to change the NAT rule and create new listeners on the self-ips that are also used for egress NOTIFYs.

     

    Any other ideas?