DNS Cache: Implementations - AskF5

DNS Cache: Implementations - AskF5

DNS Cache: Implementations

Version 11.2

Table of Contents

Table of Contents

Legal Notices.....................................................................................................................................5

Acknowledgments............................................................................................................................7

Chapter 1:  Introducing DNS Caching on the BIG-IP System...........................11

About the Transparent DNS cache.........................................................................................12

About the Resolver DNS cache..............................................................................................12

About the Validating Resolver DNS cache.............................................................................12

Chapter 2:  Configuring Fast DNS.......................................................................13

Overview: Improving DNS performance by caching responses from external resolvers........14

Task summary........................................................................................................................15

Creating a transparent DNS cache..............................................................................15

Creating a custom DNS profile for transparent DNS caching......................................15

Assigning a custom DNS profile to an LTM virtual server...........................................16

Assigning a custom DNS profile to a GTM listener.....................................................16

Creating a custom DNS monitor..................................................................................16

Creating a pool of local DNS servers..........................................................................17

Determining DNS cache performance.........................................................................17

Clearing a DNS cache.................................................................................................19

Implementation result.............................................................................................................19

Chapter 3:  Resolving Queries and Caching Responses..................................21

Overview: Improving DNS performance by resolving queries and caching responses..........22

Task summary........................................................................................................................23

Creating a resolver DNS cache...................................................................................24

Creating a custom DNS profile for DNS resolving and caching...................................24

Determining DNS cache performance.........................................................................25

Clearing a DNS cache.................................................................................................26

Implementation result.............................................................................................................27

Chapter 4:  Resolving Queries and Caching Validated Responses.................29

Overview: Resolving queries and caching validated responses.............................................30

Task summary........................................................................................................................31

Creating a validating resolver DNS cache...................................................................32

Creating a custom DNS profile for validating resolver DNS caching...........................33

Determining DNS cache performance.........................................................................33

Clearing a DNS cache.................................................................................................35

3

Table of Contents

Implementation result.............................................................................................................35

Chapter 5:  Configuring a DNS Cache to Meet Specific Needs........................37

Overview: Customizing a DNS cache.....................................................................................38

Configuring a DNS cache to answer queries for local zones.................................................38

Configuring a DNS cache to use specific root nameservers..................................................38

Configuring a DNS cache alert for cache poisoning..............................................................38

4

Legal Notices

Publication Date

This document was published on May 7, 2012.

Publication Number

MAN-0413-00

Copyright

Copyright

©

2012, F5 Networks, Inc. All rights reserved.

F5 Networks, Inc. (F5) believes the information it furnishes to be accurate and reliable. However, F5 assumes no responsibility for the use of this information, nor any infringement of patents or other rights of third parties which may result from its use. No license is granted by implication or otherwise under any patent, copyright, or other intellectual property right of F5 except as specifically described by applicable user licenses. F5 reserves the right to change specifications at any time without notice.

Trademarks

3DNS, Access Policy Manager, Acopia, Acopia Networks, Advanced Client Authentication, Advanced

Routing, APM, Application Security Manager, ARX, AskF5, ASM, BIG-IP, Cloud Extender, CloudFucious,

CMP, Data Manager, DevCentral, DevCentral [DESIGN], DNS Express, DSC, DSI, Edge Client, Edge

Gateway, Edge Portal, EM, Enterprise Manager, F5, F5 [DESIGN], F5 Management Pack, F5 Networks,

F5 World, Fast Application Proxy, Fast Cache, FirePass, Global Traffic Manager, GTM, IBR, Intelligent

Browser Referencing, Intelligent Compression, IPv6 Gateway, iApps, iControl, iHealth, iQuery, iRules, iRules OnDemand, iSession, IT agility. Your way., L7 Rate Shaping, LC, Link Controller, Local Traffic

Manager, LTM, Message Security Module, MSM, Netcelera, OneConnect, Packet Velocity, Protocol

Security Module, PSM, Real Traffic Policy Builder, Scale

N

, SSL Acceleration, StrongBox, SuperVIP, SYN

Check, TCP Express, TDR, TMOS, Traffic Management Operating System, TrafficShield, Transparent

Data Reduction, VIPRION, vCMP, WA, WAN Optimization Manager, WANJet, WebAccelerator, WOM, and ZoneRunner, are trademarks or service marks of F5 Networks, Inc., in the U.S. and other countries, and may not be used without F5's express written consent.

All other product and company names herein may be trademarks of their respective owners.

Export Regulation Notice

This product may include cryptographic software. Under the Export Administration Act, the United States government may consider it a criminal offense to export this product from the United States.

RF Interference Warning

This is a Class A product. In a domestic environment this product may cause radio interference, in which case the user may be required to take adequate measures.

FCC Compliance

This equipment has been tested and found to comply with the limits for a Class A digital device pursuant to Part 15 of FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This unit generates, uses, and

Legal Notices

can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case the user, at his own expense, will be required to take whatever measures may be required to correct the interference.

Any modifications to this device, unless expressly approved by the manufacturer, can void the user's authority to operate this equipment under part 15 of the FCC rules.

Canadian Regulatory Compliance

This Class A digital apparatus complies with Canadian ICES-003.

Standards Compliance

This product conforms to the IEC, European Union, ANSI/UL and Canadian CSA standards applicable to

Information Technology products at the time of manufacture.

6

Acknowledgments

This product includes software developed by Bill Paul.

This product includes software developed by Jonathan Stone.

This product includes software developed by Manuel Bouyer.

This product includes software developed by Paul Richards.

This product includes software developed by the NetBSD Foundation, Inc. and its contributors.

This product includes software developed by the Politecnico di Torino, and its contributors.

This product includes software developed by the Swedish Institute of Computer Science and its contributors.

This product includes software developed by the University of California, Berkeley and its contributors.

This product includes software developed by the Computer Systems Engineering Group at the Lawrence

Berkeley Laboratory.

This product includes software developed by Christopher G. Demetriou for the NetBSD Project.

This product includes software developed by Adam Glass.

This product includes software developed by Christian E. Hopps.

This product includes software developed by Dean Huxley.

This product includes software developed by John Kohl.

This product includes software developed by Paul Kranenburg.

This product includes software developed by Terrence R. Lambert.

This product includes software developed by Philip A. Nelson.

This product includes software developed by Herb Peyerl.

This product includes software developed by Jochen Pohl for the NetBSD Project.

This product includes software developed by Chris Provenzano.

This product includes software developed by Theo de Raadt.

This product includes software developed by David Muir Sharnoff.

This product includes software developed by SigmaSoft, Th. Lockert.

This product includes software developed for the NetBSD Project by Jason R. Thorpe.

This product includes software developed by Jason R. Thorpe for And Communications, http://www.and.com.

This product includes software developed for the NetBSD Project by Frank Van der Linden.

This product includes software developed for the NetBSD Project by John M. Vinopal.

This product includes software developed by Christos Zoulas.

This product includes software developed by the University of Vermont and State Agricultural College and

Garrett A. Wollman.

This product includes software developed by Balazs Scheidler ([email protected]), which is protected under the GNU Public License.

Acknowledgments

This product includes software developed by Niels Mueller ([email protected]), which is protected under the GNU Public License.

In the following statement, This software refers to the Mitsumi CD-ROM driver: This software was developed by Holger Veit and Brian Moore for use with 386BSD and similar operating systems. Similar operating

systems includes mainly non-profit oriented systems for research and education, including but not restricted to NetBSD, FreeBSD, Mach (by CMU).

This product includes software developed by the Apache Group for use in the Apache HTTP server project

(http://www.apache.org/).

This product includes software licensed from Richard H. Porter under the GNU Library General Public

License (

©

1998, Red Hat Software), www.gnu.org/copyleft/lgpl.html.

This product includes the standard version of Perl software licensed under the Perl Artistic License (

©

1997,

1998 Tom Christiansen and Nathan Torkington). All rights reserved. You may find the most current standard version of Perl at http://www.perl.com.

This product includes software developed by Jared Minch.

This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit

(http://www.openssl.org/).

This product includes cryptographic software written by Eric Young ([email protected]).

This product contains software based on oprofile, which is protected under the GNU Public License.

This product includes RRDtool software developed by Tobi Oetiker (http://www.rrdtool.com/index.html) and licensed under the GNU General Public License.

This product contains software licensed from Dr. Brian Gladman under the GNU General Public License

(GPL).

This product includes software developed by the Apache Software Foundation (http://www.apache.org/).

This product includes Hypersonic SQL.

This product contains software developed by the Regents of the University of California, Sun Microsystems,

Inc., Scriptics Corporation, and others.

This product includes software developed by the Internet Software Consortium.

This product includes software developed by Nominum, Inc. (http://www.nominum.com).

This product contains software developed by Broadcom Corporation, which is protected under the GNU

Public License.

This product contains software developed by MaxMind LLC, and is protected under the GNU Lesser General

Public License, as published by the Free Software Foundation.

This product includes software developed by the Computer Systems Engineering Group at Lawrence

Berkeley Laboratory. Copyright

©

1990-1994 Regents of the University of California. All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. All advertising materials mentioning features or use of this software must display the following acknowledgment: This product includes software developed by the Computer Systems Engineering

Group at Lawrence Berkeley Laboratory.

8

DNS Cache: Implementations

4. Neither the name of the University nor of the Laboratory may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS "AS IS" AND ANY

EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY

DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND

ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

This product includes software developed by Sony Computer Science Laboratories Inc. Copyright

©

1997-2003 Sony Computer Science Laboratories Inc. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY SONY CSL AND CONTRIBUTORS "AS IS" AND ANY EXPRESS

OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN

NO EVENT SHALL SONY CSL OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,

INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,

EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

9

Acknowledgments

10

Chapter

1

Introducing DNS Caching on the BIG-IP System

Topics:

About the Transparent DNS cache

About the Resolver DNS cache

About the Validating Resolver DNS cache

Introducing DNS Caching on the BIG-IP System

About the Transparent DNS cache

You can configure a transparent cache on the BIG-IP

®

system to use external DNS resolvers to resolve queries, and then cache the responses from the resolvers. The next time the system receives a query for a response that exists in the cache, the system immediately returns the response from the cache. The transparent cache contains messages and resource records.

A transparent cache in the BIG-IP system consolidates content that would otherwise be cached across multiple external resolvers. When a consolidated cache is in front of external resolvers (each with their own cache), it can produce a much higher cache hit percentage.

F5 Networks recommends that you configure the BIG-IP system to forward queries, which cannot be answered from the cache, to a pool of local DNS servers rather than the local BIND instance because BIND performance is slower than using multiple external resolvers.

Note: For systems using the DNS Express

feature, the BIG-IP system first processes the requests through DNS Express, and then caches the responses.

About the Resolver DNS cache

You can configure a resolver cache on the BIG-IP

®

system to resolve DNS queries and cache the responses.

The next time the system receives a query for a response that exists in the cache, the system returns the response from the cache. The resolver cache contains messages, resource records, and the nameservers the system queries to resolve DNS queries.

It is important for network architects to note that it is possible to configure the local BIND instance on the

BIG-IP

®

system to act as an external DNS resolver. However, F5 Networks does not recommend this approach, because the performance of BIND is slower than using a resolver cache.

About the Validating Resolver DNS cache

You can configure a validating resolver cache on the BIG-IP

®

system to recursively query public DNS servers, validate the identity of the DNS server sending the responses, and then cache the responses. The next time the system receives a query for a response that exists in the cache, the system returns the

DNSSEC-compliant response from the cache. The validating resolver cache contains messages, resource records, the nameservers the system queries to resolve DNS queries, and DNSSEC keys.

Using the validating resolver cache, the BIG-IP system mitigates cache poisoning by validating DNS responses using DNSSEC validation. This is important, because attackers can attempt to populate a DNS cache with erroneous data that redirects clients to fake web sites, or downloads malware and viruses to client computers. When an authoritative server signs a DNS response, the validating resolver verifies the data before entering the data into the cache. Additionally, the validating resolver cache includes a built-in filter and detection mechanism that rejects unsolicited DNS responses.

12

Chapter

2

Configuring Fast DNS

Topics:

Overview: Improving DNS performance by caching responses from external resolvers

Task summary

Implementation result

Configuring Fast DNS

Overview: Improving DNS performance by caching responses from external resolvers

You can configure a transparent cache on the BIG-IP

®

system to use external DNS resolvers to resolve queries, and then cache the responses from the resolvers. The next time the system receives a query for a response that exists in the cache, the system immediately returns the response from the cache. The transparent cache contains messages and resource records.

A transparent cache in the BIG-IP system consolidates content that would otherwise be cached across multiple external resolvers. When a consolidated cache is in front of external resolvers (each with their own cache), it can produce a much higher cache hit percentage.

F5 Networks recommends that you configure the BIG-IP system to forward queries, which cannot be answered from the cache, to a pool of local DNS servers rather than the local BIND instance because BIND performance is slower than using multiple external resolvers.

Note: For systems using the DNS Express

feature, the BIG-IP system first processes the requests through DNS Express, and then caches the responses.

14

Figure 1: Illustration of BIG-IP system using transparent cache

DNS Cache: Implementations

Task summary

Perform these tasks to configure a transparent cache on the BIG-IP

®

system.

Creating a transparent DNS cache

Creating a custom DNS profile for transparent DNS caching

Assigning a custom DNS profile to an LTM virtual server

Assigning a custom DNS profile to a GTM listener

Creating a custom DNS monitor

Creating a pool of local DNS servers

Determining DNS cache performance

Clearing a DNS cache

Creating a transparent DNS cache

Create a transparent cache on the BIG-IP

®

system when you want the system to cache DNS responses from external DNS resolvers.

1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List.

The DNS Cache List screen opens.

2. Click Create.

The New DNS Cache screen opens.

3. In the Name field, type a name for the cache.

4. From the Resolver Type list, select Transparent.

5. Click Finished.

Associate the DNS cache with a custom DNS profile.

Creating a custom DNS profile for transparent DNS caching

Ensure that at least one transparent cache exists on the BIG-IP

®

system.

You can create a custom DNS profile to configure the BIG-IP system to cache responses to DNS queries.

1. On the Main tab, click Local Traffic > Profiles > Services > DNS.

The DNS profile list screen opens.

2. Click Create.

The New DNS Profile screen opens.

3. In the Name field, type a name for the profile.

4. In the Parent Profile list, accept the default dns profile.

5. Select the Custom check box.

The fields in the Settings area become available for revision.

6. From the Use BIND Server on BIG-IP list, select Disabled.

7. From the DNS Cache list, select Enabled.

When you enable the DNS Cache option, you must also select a DNS cache from the DNS Cache Name list.

15

Configuring Fast DNS

8. From the DNS Cache Name list, select the DNS cache that you want to associate with this profile.

You can associate a DNS cache with a profile, even when the DNS Cache option, is Disabled. This allows you to enable and disable the cache for debugging purposes.

9. Click Finished.

Assign the custom DNS profile to the virtual server that handles the DNS traffic from which you want to cache responses.

Assigning a custom DNS profile to an LTM virtual server

Ensure that at least one custom DNS profile that is configured for DNS caching exists on the BIG-IP

® system.

You can assign a custom DNS profile to a virtual server to enable the BIG-IP system to perform DNS caching on the traffic the virtual server handles.

Note: This task applies only to LTM-provisioned systems.

1. On the Main tab, click Local Traffic > Virtual Servers.

The Virtual Server List screen displays a list of existing virtual servers.

2. Click the name of the virtual server you want to modify.

3. From the Configuration list, select Advanced.

4. From the DNS Profile list, select the custom DNS profile you created.

5. Click Finished.

The responses to DNS queries handled by this virtual server are cached on the BIG-IP system.

Assigning a custom DNS profile to a GTM listener

Ensure that at least one custom DNS profile that is configured for DNS caching exists on the BIG-IP

® system.

You can assign a custom DNS profile to a listener to enable the BIG-IP system to perform DNS caching on the traffic the listener handles.

Note: This task applies only to GTM-provisioned systems.

1. On the Main tab, click Global Traffic > Listeners.

The Listeners List screen opens.

2. Click the name of the listener you want to modify.

3. From the DNS Profile list, select the custom DNS profile you created for DNS caching.

4. Click Finished.

Creating a custom DNS monitor

Create a custom DNS monitor to send DNS requests, generated using the settings you specify, to a pool of

DNS servers and validate the DNS responses.

16

DNS Cache: Implementations

Important: When defining values for custom monitors, make sure you avoid using any values that are on the list of reserved keywords. For more information, see solution number 3653 (for version

9.0 systems and later) on the AskF5

technical support web site.

1. On the Main tab, click Local Traffic > Monitors.

The Monitor List screen opens.

2. Click Create.

The New Monitor screen opens.

3. Type a name for the monitor in the Name field.

4. From the Type list, select DNS.

5. In the Configuration area of the screen, select Advanced.

This selection makes it possible for you to modify additional default settings.

6. Configure settings based on your network requirements.

7. Click Finished.

Creating a pool of local DNS servers

Ensure that you have created a custom DNS monitor to assign to the pool of DNS servers. Gather the IP addresses of the DNS servers that you want to include in a pool to which the BIG-IP

®

system load balances

DNS traffic.

1. Log in to the command-line interface of the BIG-IP system.

2. Type tmsh

, to access the Traffic Management Shell.

3. Run a variation on this command sequence to create a pool using the IP addresses of the DNS servers on your network: create /ltm pool DNS_pool members add { 10.10.1.1:domain

10.10.1.2:domain 10.10.1.3:domain } monitor my_custom_dns_monitor

Note:

:domain

indicates the DNS port.

When you run this example command, the system creates a pool named

DNS_pool

that includes three

DNS servers with the following IP addresses:

10.10.1.1

,

10.10.1.2

, and

10.10.1.3

. The custom

DNS monitor you created to monitor DNS servers is assigned to the pool. The monitor sends DNS requests to the pool of DNS servers and validates the DNS responses.

4. Run this command sequence to save the pool: save /sys config

5. Run this command sequence to display the pool: list /ltm pool

6. Verify that the pool is configured correctly.

Determining DNS cache performance

You can view statistics to determine how well a DNS cache on the BIG-IP

®

system is performing.

1. On the Main tab, click Statistics > Module Statistics > Local Traffic.

The Local Traffic Statistics screen opens.

2. From the Statistics Type list, select DNS Cache.

3. In the Details column for a cache, click View, to display detailed information about the cache.

4. To return to the Local Traffic Statistics screen, click Back.

17

Configuring Fast DNS

Viewing records in a DNS cache

You can view records in a DNS cache to determine how well a specific cache on the BIG-IP

®

system is performing.

1. Log in to the command-line interface of the BIG-IP system.

2. At the BASH prompt, type tmsh

.

3. At the tmsh prompt, type show ltm dns cache <cache type> <cache name>

, and press Enter.

For example, the command sequence show ltm dns cache transparent my_transparent_cache

, displays the messages and resource records in the transparent cache named my_transparent_cache

.

Viewing DNS cache statistics using tmsh

You can view DNS cache statistics using tmsh to determine how well a specific cache on the BIG-IP

® system is performing.

1. Log in to the command-line interface of the BIG-IP system.

2. At the BASH prompt, type tmsh

.

3. At the tmsh prompt, type show ltm dns cache

, and press Enter.

Statistics for all of the DNS caches on the BIG-IP system display.

4. At the tmsh prompt, type show ltm dns cache <cache-type>

, and press Enter.

For example, the command sequence show ltm dns cache transparent

, displays statistics for each of the transparent caches on the system.

5. At the tmsh prompt, type show ltm dns cache <cache type> <cache name>

, and press Enter.

For example, the command sequence, show ltm dns cache transparent my_t1

, displays statistics for the transparent cache on the system named my_t1

.

Managing transparent cache size

Determine the amount of memory the BIG-IP

®

system has and how much of that memory you want to commit to DNS caching. View the statistics for a cache to determine how well the cache is working.

You can change the size of a DNS cache to fix cache performance issues.

1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List.

The DNS Cache List screen opens.

2. Click the name of the cache you want to modify.

3. In the Message Cache Size field, type the maximum size in bytes for the DNS message cache.

The BIG-IP system caches the messages in a DNS response in the message cache. A higher maximum size makes if possible for more DNS responses to be cached and increases the cache hit percentage. A lower maximum size forces earlier eviction of cached content, but can lower the cache hit percentage.

Important: The message cache size includes all tmms on the BIG-IP system; therefore, if there are eight tmms, multiply the size by eight and put that value in this field.

4. In the Resource Record Cache Size field, type the maximum size in bytes for the DNS resource record cache.

The BIG-IP system caches the supporting records in a DNS response in the Resource Record cache. A higher maximum size makes if possible for more DNS responses to be cached and increases the cache

18

DNS Cache: Implementations

hit percentage. A lower maximum size forces earlier eviction of cached content, but can lower the cache hit percentage.

Important: The resource record cache size includes all tmms on the BIG-IP system; therefore, if there are eight tmms, multiply the size by eight and put that value in this field.

5. Click Finished.

Clearing a DNS cache

You can clear all records from a specific DNS cache on the BIG-IP

®

system.

1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List.

The DNS Cache List screen opens.

2. Click the Statistics tab.

The Local Traffic Statistics screen opens.

3. Select the check box next to the cache you want to clear, and then click Clear Cache.

Clearing specific records from a DNS cache

You can clear specific records from a DNS cache using tmsh. For example, you can delete all RRSET records or only the A records in the specified cache.

Tip: In tmsh, you can use the command completion feature to discover the types of records that are available for deletion.

1. Log in to the command-line interface of the BIG-IP

®

system.

2. At the BASH prompt, type tmsh

.

3. At the tmsh prompt, type ltm dns cache records

, and press Enter to navigate to the dns cache records module.

4. Type delete <cache-type> type <record-type> cache <cache-name>

, and press Enter.

For example, the command sequence delete rrset type a cache my_resolver_cache

, deletes the A records from the resource record cache of the resolver cache named my_resolver_cache

.

Implementation result

You now have an implementation in which the BIG-IP

®

system caches DNS responses from external DNS resolvers, and answers queries for a cached response. Additionally, the system forwards DNS queries that cannot be answered from the cache to a pool of local DNS servers.

19

Configuring Fast DNS

20

Chapter

3

Resolving Queries and Caching Responses

Topics:

Overview: Improving DNS performance by resolving queries and caching responses

Task summary

Implementation result

Resolving Queries and Caching Responses

Overview: Improving DNS performance by resolving queries and caching responses

You can configure a resolver cache on the BIG-IP

®

system to resolve DNS queries and cache the responses.

The next time the system receives a query for a response that exists in the cache, the system returns the response from the cache. The resolver cache contains messages, resource records, and the nameservers the system queries to resolve DNS queries.

22

DNS Cache: Implementations

Figure 2: Illustration of BIG-IP system using resolver cache

Task summary

Perform these tasks to configure a resolver cache on the BIG-IP

®

system.

23

Resolving Queries and Caching Responses

Creating a resolver DNS cache

Creating a custom DNS profile for DNS resolving and caching

Determining DNS cache performance

Clearing a DNS cache

Creating a resolver DNS cache

Create a resolver cache on the BIG-IP

®

system when you want the system to resolve DNS queries and cache responses.

1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List.

The DNS Cache List screen opens.

2. Click Create.

The New DNS Cache screen opens.

3. In the Name field, type a name for the cache.

4. From the Resolver Type list, select Resolver.

5. Click Finished.

Associate the DNS cache with a custom DNS profile.

Creating a custom DNS profile for DNS resolving and caching

Ensure that at least one DNS cache exists on the BIG-IP

®

system.

You can create a custom DNS profile to configure the BIG-IP

®

system to cache responses to DNS connection requests.

1. On the Main tab, click Local Traffic > Profiles > Services > DNS.

The DNS profile list screen opens.

2. Click Create.

The New DNS Profile screen opens.

3. In the Name field, type a name for the profile.

4. Select the Custom check box.

The fields in the Settings area become available for revision.

5. From the Use BIND Server on BIG-IP list, select Disabled.

6. From the DNS Cache list, select Enabled.

When you enable the DNS Cache option, you must also select a DNS cache from the DNS Cache Name list.

7. From the DNS Cache Name list, select the DNS cache that you want to associate with this profile.

You can associate a DNS cache with a profile, even when the DNS Cache option, is Disabled. This allows you to enable and disable the cache for debugging purposes.

8. Click Finished.

Assign the custom DNS profile to the virtual server handling the DNS traffic, which includes the responses to queries that you want to cache.

24

DNS Cache: Implementations

Determining DNS cache performance

You can view statistics to determine how well a DNS cache on the BIG-IP

®

system is performing.

1. On the Main tab, click Statistics > Module Statistics > Local Traffic.

The Local Traffic Statistics screen opens.

2. From the Statistics Type list, select DNS Cache.

3. In the Details column for a cache, click View, to display detailed information about the cache.

4. To return to the Local Traffic Statistics screen, click Back.

Viewing records in a DNS cache

You can view records in a DNS cache to determine how well a specific cache on the BIG-IP

®

system is performing.

1. Log in to the command-line interface of the BIG-IP system.

2. At the BASH prompt, type tmsh

.

3. At the tmsh prompt, type show ltm dns cache <cache type> <cache name>

, and press Enter.

For example, the command sequence show ltm dns cache transparent my_transparent_cache

, displays the messages and resource records in the transparent cache named my_transparent_cache

.

Viewing DNS cache statistics using tmsh

You can view DNS cache statistics using tmsh to determine how well a specific cache on the BIG-IP

® system is performing.

1. Log in to the command-line interface of the BIG-IP system.

2. At the BASH prompt, type tmsh

.

3. At the tmsh prompt, type show ltm dns cache

, and press Enter.

Statistics for all of the DNS caches on the BIG-IP system display.

4. At the tmsh prompt, type show ltm dns cache <cache-type>

, and press Enter.

For example, the command sequence show ltm dns cache transparent

, displays statistics for each of the transparent caches on the system.

5. At the tmsh prompt, type show ltm dns cache <cache type> <cache name>

, and press Enter.

For example, the command sequence, show ltm dns cache transparent my_t1

, displays statistics for the transparent cache on the system named my_t1

.

Managing cache size

Determine the amount of memory the BIG-IP

®

system has and how much you want to commit to DNS caching. View the statistics for a cache to determine how well the cache is working.

You can change the size of a DNS cache to fix cache performance issues.

1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List.

The DNS Cache List screen opens.

2. Click the name of the cache you want to modify.

3. In the Message Cache Size field, type the maximum size in bytes for the DNS message cache.

25

Resolving Queries and Caching Responses

The BIG-IP system caches the messages in a DNS response in the message cache. A higher maximum size makes if possible for more DNS responses to be cached and increases the cache hit percentage. A lower maximum size forces earlier eviction of cached content, but can lower the cache hit percentage.

Important: The message cache size includes all tmms on the BIG-IP system; therefore, if there are eight tmms, multiply the size by eight and put that value in this field.

4. In the Resource Record Cache Size field, type the maximum size in bytes for the DNS resource record cache.

The BIG-IP system caches the supporting records in a DNS response in the Resource Record cache. A higher maximum size makes if possible for more DNS responses to be cached and increases the cache hit percentage. A lower maximum size forces earlier eviction of cached content, but can lower the cache hit percentage.

Important: The resource record cache size includes all tmms on the BIG-IP system; therefore, if there are eight tmms, multiply the size by eight and put that value in this field.

5. In the Nameserver Cache Count field, type the maximum number of DNS nameservers for which the

BIG-IP

®

system caches connection and capability data.

Important: The nameserver cache count includes all tmms on the BIG-IP system; therefore, if there are eight tmms, multiply the count by eight and put that value in this field.

6. In the Unsolicited Reply Threshold field, change the default value if you are using the BIG-IP

®

system to monitor for unsolicited replies using SNMP.

The system always rejects unsolicited replies. The default value of 0 (off) indicates the system does not generate SNMP traps or log messages when rejecting unsolicited replies. Changing the default value alerts you to a potential security attack, such as cache poisoning or DOS. For example, if you specify

1,000,000 unsolicited replies, each time the system receives 1,000,000 unsolicited replies, it generates an SNMP trap and log message.

7. Click Finished.

Clearing a DNS cache

You can clear all records from a specific DNS cache on the BIG-IP

®

system.

1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List.

The DNS Cache List screen opens.

2. Click the Statistics tab.

The Local Traffic Statistics screen opens.

3. Select the check box next to the cache you want to clear, and then click Clear Cache.

Clearing specific records from a DNS cache

You can clear specific records from a DNS cache using tmsh. For example, you can delete all RRSET records or only the A records in the specified cache.

Tip: In tmsh, you can use the command completion feature to discover the types of records that are available for deletion.

26

DNS Cache: Implementations

1. Log in to the command-line interface of the BIG-IP

®

system.

2. At the BASH prompt, type tmsh

.

3. At the tmsh prompt, type ltm dns cache records

, and press Enter to navigate to the dns cache records module.

4. Type delete <cache-type> type <record-type> cache <cache-name>

, and press Enter.

For example, the command sequence delete rrset type a cache my_resolver_cache

, deletes the A records from the resource record cache of the resolver cache named my_resolver_cache

.

Implementation result

You now have an implementation in which the BIG-IP

®

system acts as a DNS resolver, caches DNS responses, and answers queries for a cached response from the cache.

27

Resolving Queries and Caching Responses

28

Chapter

4

Resolving Queries and Caching Validated Responses

Topics:

Overview: Resolving queries and caching validated responses

Task summary

Implementation result

Resolving Queries and Caching Validated Responses

Overview: Resolving queries and caching validated responses

You can configure a validating resolver cache on the BIG-IP

®

system to recursively query public DNS servers, validate the identity of the DNS server sending the responses, and then cache the responses. The next time the system receives a query for a response that exists in the cache, the system returns the

DNSSEC-compliant response from the cache. The validating resolver cache contains messages, resource records, the nameservers the system queries to resolve DNS queries, and DNSSEC keys.

Using the validating resolver cache, the BIG-IP system mitigates cache poisoning by validating DNS responses using DNSSEC validation. This is important, because attackers can attempt to populate a DNS cache with erroneous data that redirects clients to fake web sites, or downloads malware and viruses to client computers. When an authoritative server signs a DNS response, the validating resolver verifies the data before entering the data into the cache. Additionally, the validating resolver cache includes a built-in filter and detection mechanism that rejects unsolicited DNS responses.

30

DNS Cache: Implementations

Figure 3: Illustration of BIG-IP system using validating resolver cache

Task summary

Perform these tasks to configure a validating resolver cache on the BIG-IP

®

system.

Creating a validating resolver DNS cache

Creating a custom DNS profile for validating resolver DNS caching

31

Resolving Queries and Caching Validated Responses

Determining DNS cache performance

Clearing a DNS cache

Creating a validating resolver DNS cache

Create a validating resolver cache on the BIG-IP

®

system when you want the system to resolve DNS queries, use DNSSEC to validate the responses, and cache the responses.

1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List.

The DNS Cache List screen opens.

2. Click Create.

The New DNS Cache screen opens.

3. In the Name field, type a name for the cache.

4. From the Resolver Type list, select Validating Resolver.

5. Click Finished.

Associate the DNS cache with a custom DNS profile.

Creating a trust anchor for a validating resolver DNS cache

You must create a trust anchor for a validating resolver to be able to validate content in a DNS response.

1. From a client, run the command dig @ldns_ipaddress <zone> DNSKEY

, and then copy the 257 record type key.

This is an example of a 257 record type key.

. 500 IN DNSKEY 257 3 5

AwEAAds8tHDE1wQgDjJ8/fE7aunu9Kc5bNcGcsKvVc3D1Y4mRIBnLm4q f42b5eu2aPZB/SEYD76qOhYLNnvnRel510Rx0yF77qy3vWfgBImzRxy4

JUVlewG0k4zKpiOo8ZFFLX7kGvLF1o2LUa3B2OjPZBo3KPdlwr8xVzU0 ypJfIE/9kuAq81EplXRshn5i7owU8hhEMmEfa+e/9vnsdNckUe+7gHYr

ToDftWxS+XkRkC6Q8Yfp/25hsTi1ZbSytoXc1+syDwh1pykxvYq+526R

3m8Yy74Hd987/IXRjuRi6X4WWq282Cm2FQRsgNCTLPwwjZ0nDB6dhfUp

DsawoAw8f4k=

2. Log on to the command-line interface of the BIG-IP

®

system.

3. At the BASH prompt, type tmsh

, and press Enter.

4. At the tmsh prompt, type ltm dns cache validating-resolver

, and press Enter.

5. Type modify <validating-resolver name> trust-anchors add { " <paste the

contents of the 257 record type key that you copied here> " }

, and press Enter.

For example, modify my_validating_resolver trust-anchors add

{ " . 500 IN DNSKEY 257 3 5

AwEAAds8tHDE1wQgDjJ8/fE7aunu9Kc5bNcGcsKvVc3D1Y4mRIBnLm4q f42b5eu2aPZB/SEYD76qOhYLNnvnRel510Rx0yF77qy3vWfgBImzRxy4

JUVlewG0k4zKpiOo8ZFFLX7kGvLF1o2LUa3B2OjPZBo3KPdlwr8xVzU0 ypJfIE/9kuAq81EplXRshn5i7owU8hhEMmEfa+e/9vnsdNckUe+7gHYr

ToDftWxS+XkRkC6Q8Yfp/25hsTi1ZbSytoXc1+syDwh1pykxvYq+526R

3m8Yy74Hd987/IXRjuRi6X4WWq282Cm2FQRsgNCTLPwwjZ0nDB6dhfUp

DsawoAw8f4k

}

32

DNS Cache: Implementations

Creating a custom DNS profile for validating resolver DNS caching

Ensure that at least one DNS cache exists on the BIG-IP

®

system.

You can create a custom DNS profile to configure the BIG-IP

®

system to cache responses to DNS connection requests.

1. On the Main tab, click Local Traffic > Profiles > Services > DNS.

The DNS profile list screen opens.

2. Click Create.

The New DNS Profile screen opens.

3. In the Name field, type a name for the profile.

4. In the Parent Profile list, accept the default dns profile.

5. Select the Custom check box.

The fields in the Settings area become available for revision.

6. From the Use BIND Server on BIG-IP list, select Disabled.

7. From the DNS Cache list, select Enabled.

When you enable the DNS Cache option, you must also select a DNS cache from the DNS Cache Name list.

8. From the DNS Cache Name list, select the DNS cache that you want to associate with this profile.

You can associate a DNS cache with a profile, even when the DNS Cache option, is Disabled. This allows you to enable and disable the cache for debugging purposes.

9. Click Finished.

Assign the custom DNS profile to the virtual server that handles the DNS traffic that includes the responses to queries that you want to cache.

Determining DNS cache performance

You can view statistics to determine how well a DNS cache on the BIG-IP

®

system is performing.

1. On the Main tab, click Statistics > Module Statistics > Local Traffic.

The Local Traffic Statistics screen opens.

2. From the Statistics Type list, select DNS Cache.

3. In the Details column for a cache, click View, to display detailed information about the cache.

4. To return to the Local Traffic Statistics screen, click Back.

Viewing records in a DNS cache

You can view records in a DNS cache to determine how well a specific cache on the BIG-IP

®

system is performing.

1. Log in to the command-line interface of the BIG-IP system.

2. At the BASH prompt, type tmsh

.

3. At the tmsh prompt, type show ltm dns cache <cache type> <cache name>

, and press Enter.

For example, the command sequence show ltm dns cache transparent my_transparent_cache

, displays the messages and resource records in the transparent cache named my_transparent_cache

.

33

Resolving Queries and Caching Validated Responses

Viewing DNS cache statistics using tmsh

You can view DNS cache statistics using tmsh to determine how well a specific cache on the BIG-IP

® system is performing.

1. Log in to the command-line interface of the BIG-IP system.

2. At the BASH prompt, type tmsh

.

3. At the tmsh prompt, type show ltm dns cache

, and press Enter.

Statistics for all of the DNS caches on the BIG-IP system display.

4. At the tmsh prompt, type show ltm dns cache <cache-type>

, and press Enter.

For example, the command sequence show ltm dns cache transparent

, displays statistics for each of the transparent caches on the system.

5. At the tmsh prompt, type show ltm dns cache <cache type> <cache name>

, and press Enter.

For example, the command sequence, show ltm dns cache transparent my_t1

, displays statistics for the transparent cache on the system named my_t1

.

Managing cache size

Determine the amount of memory the BIG-IP

®

system has and how much you want to commit to DNS caching. View the statistics for a cache to determine how well the cache is working.

You can change the size of a DNS cache to fix cache performance issues.

1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List.

The DNS Cache List screen opens.

2. Click the name of the cache you want to modify.

3. In the Message Cache Size field, type the maximum size in bytes for the DNS message cache.

The BIG-IP system caches the messages in a DNS response in the message cache. A higher maximum size makes if possible for more DNS responses to be cached and increases the cache hit percentage. A lower maximum size forces earlier eviction of cached content, but can lower the cache hit percentage.

Important: The message cache size includes all tmms on the BIG-IP system; therefore, if there are eight tmms, multiply the size by eight and put that value in this field.

4. In the Resource Record Cache Size field, type the maximum size in bytes for the DNS resource record cache.

The BIG-IP system caches the supporting records in a DNS response in the Resource Record cache. A higher maximum size makes if possible for more DNS responses to be cached and increases the cache hit percentage. A lower maximum size forces earlier eviction of cached content, but can lower the cache hit percentage.

Important: The resource record cache size includes all tmms on the BIG-IP system; therefore, if there are eight tmms, multiply the size by eight and put that value in this field.

5. In the Nameserver Cache Count field, type the maximum number of DNS nameservers for which the

BIG-IP

®

system caches connection and capability data.

Important: The nameserver cache count includes all tmms on the BIG-IP system; therefore, if there are eight tmms, multiply the count by eight and put that value in this field.

34

DNS Cache: Implementations

6. In the Unsolicited Reply Threshold field, change the default value if you are using the BIG-IP

®

system to monitor for unsolicited replies using SNMP.

The system always rejects unsolicited replies. The default value of 0 (off) indicates the system does not generate SNMP traps or log messages when rejecting unsolicited replies. Changing the default value alerts you to a potential security attack, such as cache poisoning or DOS. For example, if you specify

1,000,000 unsolicited replies, each time the system receives 1,000,000 unsolicited replies, it generates an SNMP trap and log message.

7. Click Finished.

Clearing a DNS cache

You can clear all records from a specific DNS cache on the BIG-IP

®

system.

1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List.

The DNS Cache List screen opens.

2. Click the Statistics tab.

The Local Traffic Statistics screen opens.

3. Select the check box next to the cache you want to clear, and then click Clear Cache.

Clearing specific records from a DNS cache

You can clear specific records from a DNS cache using tmsh. For example, you can delete all RRSET records or only the A records in the specified cache.

Tip: In tmsh, you can use the command completion feature to discover the types of records that are available for deletion.

1. Log in to the command-line interface of the BIG-IP

®

system.

2. At the BASH prompt, type tmsh

.

3. At the tmsh prompt, type ltm dns cache records

, and press Enter to navigate to the dns cache records module.

4. Type delete <cache-type> type <record-type> cache <cache-name>

, and press Enter.

For example, the command sequence delete rrset type a cache my_resolver_cache

, deletes the A records from the resource record cache of the resolver cache named my_resolver_cache

.

Implementation result

You now have an implementation in which the BIG-IP

®

system acts as a DNS resolver, verifies the validity of the responses, caches DNSSEC-compliant responses, and answers queries for a cached response with a

DNSSEC-compliant response from the cache.

35

Resolving Queries and Caching Validated Responses

36

Chapter

5

Configuring a DNS Cache to Meet Specific Needs

Topics:

Overview: Customizing a DNS cache

Configuring a DNS cache to answer queries for local zones

Configuring a DNS cache to use specific root nameservers

Configuring a DNS cache alert for cache poisoning

Configuring a DNS Cache to Meet Specific Needs

Overview: Customizing a DNS cache

You can customize a DNS cache on the BIG-IP

®

system to meet specific network needs by changing the default values on the DNS cache settings.

Configuring a DNS cache to answer queries for local zones

You can configure a DNS cache on the BIG-IP

®

system to answer client requests for local zones.

1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List.

The DNS Cache List screen opens.

2. Click the name of the cache you want to modify.

3. Select the Enabled check box for the Answer Default Zones setting, when you want the BIG-IP

® system to answer queries for the default zones: localhost, reverse 127.0.0.1 and ::1, and AS112 zones.

4. Click Update.

Configuring a DNS cache to use specific root nameservers

You can configure a resolver or validating resolver DNS cache on the BIG-IP

®

system to use a specific server as an authoritative nameserver for the DNS root nameservers.

1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List.

The DNS Cache List screen opens.

2. Click the name of the cache you want to modify.

3. In the Root Hints section, in the IP address field, type the IP address of a DNS server that the system considers authoritative for the DNS root nameservers, and then click Add.

Caution: By default, the system uses the DNS root nameservers published by InterNIC. When you add DNS root nameservers, the BIG-IP system no longer uses the default nameservers published by InterNIC, but uses the nameservers you add as authoritative for the DNS root nameservers.

Based on your network configuration, add IPv4 or IPv6 addresses or both.

4. Click Update.

38

Configuring a DNS cache alert for cache poisoning

You can configure a resolver or validating resolver DNS cache on the BIG-IP

®

system to generate SNMP alerts and log messages when the cache receives unsolicited replies. This is helpful as an alert to a potential security attack, such as cache poisoning or DOS.

DNS Cache: Implementations

1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List.

The DNS Cache List screen opens.

2. Click the name of the cache you want to modify.

3. In the Unsolicited Reply Threshold field, change the default value if you are using the BIG-IP

®

system to monitor for unsolicited replies using SNMP.

The system always rejects unsolicited replies. The default value of 0 (off) indicates the system does not generate SNMP traps or log messages when rejecting unsolicited replies. Changing the default value alerts you to a potential security attack, such as cache poisoning or DOS. For example, if you specify

1,000,000 unsolicited replies, each time the system receives 1,000,000 unsolicited replies, it generates an SNMP trap and log message.

4. Click Update.

39

Configuring a DNS Cache to Meet Specific Needs

40

Index

C

cache, viewing statistics 17, 25, 33

cache clearing 19, 26, 35

cache poisoning, and configuring SNMP alerts 38

cache size, managing 25, 34

caching, and DNS profiles 15, 24, 33

custom DNS profiles, and caching DNS responses 15

custom monitor

creating DNS 16

D

DNS cache

about configuring for specific needs 38

about resolver 12, 22

about transparent 14

about validating resolver 12, 30

clearing 19, 26, 35

configuring to alert for cache poisoning 38 configuring to answer queries for local zones 38 configuring to generate SNMP alerts 38 configuring to use specific root nameservers 38

configuring transparent 12

creating resolver 24

creating transparent 15

creating trust anchor for validating resolver 32 creating validating resolver 32

managing cache size 25, 34

managing transparent cache size 18

viewing 18, 25, 33

viewing statistics 17, 19, 25, 26, 33, 35

viewing statistics using tmsh 18, 25, 34

DNS cache profiles

assigning to listeners 16 assigning to virtual servers 16

customizing to cache DNS responses 15, 24, 33

DNS monitor

creating 16

DNS profiles

assigning to listeners 16

DNS profiles, customizing to cache DNS responses 15, 24, 33

DNS servers

and creating pools 17

and custom DNS cache profiles 16

L

listeners, assigning a custom DNS profile for DNS caching 16

local zones, and configuring cache to answer queries 38

M

message cache

managing size 25, 34

managing size for transparent cache 18

N

nameserver cache, managing size 25, 34

P

pools, and DNS servers 17

profiles, creating custom DNS 15, 24, 33

R

resolver cache

about 22

creating 24

resource record cache

managing size 25, 34

managing size for transparent cache 18

root nameservers, and DNS cache 38

S

SNMP alerts

and cache poisoning 38

configuring cache to generate 25, 34

statistics, viewing cache statistics 17, 25, 33

T

tmsh

using to create trust anchors 32

using to view cache statistics 18, 25, 34

transparent cache

about 14

creating 15

managing size 18

trust anchor, creating for validating resolver 32

U

Unsolicited Replies Threshold setting, modifying 25, 34

V

validating resolver cache

about 30

creating 32

Index

41

Index

validating resolver cache (continued)

creating trust anchors 32

virtual servers, assigning DNS cache profiles 16

42

Was this manual useful for you? yes no
Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

Download PDF

advertisement

Table of contents