Forum Discussion

Paul_Hoyland's avatar
Paul_Hoyland
Icon for Nimbostratus rankNimbostratus
May 21, 2019

BIGIP DNS - What configuration get replicated by Sync group

Can anyone point me at some resources that explain what is replicated among devices by configuration sync on BIG-IP DNS? It seems that things like listeners and DNS profiles aren't synced so just want to understand what is and what isn't replicated.

 

thanks

 

Paul

application delivery
BIG-IP DNS
operations
sync

8 Replies

Sort By
  • Andy_McGrath's avatar
    Andy_McGrath
    Icon for Cumulonimbus rankCumulonimbus
    May 21, 2019

    You have two different Sync configuration on F5 DNS:

    • F5 DNS sync group where DNS and BIND configuration can be synced between all F5 DNS members of the group look under DNS >> Settings >> GSLB >> General (Configuration Synchronization) where you can set the group name and what to Synchronize
      • https://support.f5.com/csp/article/K13734
      • https://support.f5.com/csp/article/K13690

     

    • F5 Device Group and HA are used more for LTM and other modules that need to failover this will sync up LTM based configuration and will work in an Active/Standby for each Traffic Group configured. Recommend you do not do this for F5 DNS/GTM as better to have all devices Active and failover is not required as DNS is already a fault tolerant protocol.
  • Paul_Hoyland's avatar
    Paul_Hoyland
    Icon for Nimbostratus rankNimbostratus
    May 21, 2019

    Settings >> GSLB >> General does give me some information but doesn't tell me whether WIPs are synchronized and Listeners are not (for example). Is there any documentation that does give me that detail?

  • Andy_McGrath's avatar
    Andy_McGrath
    Icon for Cumulonimbus rankCumulonimbus
    May 21, 2019

    Tried to find something but nothing substantial, best way to look at it is:

    • Anything that is written to the configuration file `bigip_gtm.conf` will be synced between devices in the same F5 DNS sync group.
    • Anything written to the internal BIND DNS server zone files will be synced if you have enabled to sync zone files.

     

    Configuration around listeners and DNS pools etc. is actually LTM configuration, hence why it doesn't sync.

  • patonbike's avatar
    patonbike
    Icon for Cirrus rankCirrus
    Oct 03, 2019

    I have turned on settings -> gslb -> general "Configuration Synchronization" and "Synchronize DNS Zone Files" and I am not seeing the bind zones replicate after initial import (which does synchronize). There are no errors. Any ideas on what to check?

    • merlin87's avatar
      merlin87
      Icon for Nimbostratus rankNimbostratus
      Oct 04, 2019

      I would check that you have the same Sync Group Name specified on each GTM and also you would need to run the gtm_add command from bash once from each GTM you are pulling into the GTM Mesh, to get them to swap certs and build the iQuery connections.

       

      Sync Group: DNS > Settings > GSLB > Group Name

       

      https://support.f5.com/csp/article/K13312

       

      Checking the sync connection with iQuery from the bash prompt and checking in /var/gtm should give you an idea as to what the issue may be.

       

      https://support.f5.com/csp/article/K13690

      • patonbike's avatar
        patonbike
        Icon for Cirrus rankCirrus
        Oct 04, 2019

        It doesn't seem to like the BIGIP generated certificate of the peer. For example iqdump 127.0.0.1 works on either of the 2 units, however iqdump my.peer.ip.here yields :

         

        47935202178032:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:1134:

         

        However, when I go to System ›› Device Certificates : Trusted Device Certificates ›› Trusted Device Certificates, both certs from both BIGIPs are listed on both bigips. So they should trust one another's certs. Seems like we're missing a spot where the cert needs to be trusted.