Applies To:

Show Versions Show Versions

Manual Chapter: Configuring DNS Caching
Manual Chapter
Table of Contents   |   << Previous Chapter   |   Next Chapter >>

About the Transparent DNS cache

You can configure a transparent cache on the BIG-IP system to use external DNS resolvers to resolve queries, and then cache the responses from the resolvers. The next time the system receives a query for a response that exists in the cache, the system immediately returns the response from the cache. The transparent cache contains messages and resource records.

A transparent cache in the BIG-IP system consolidates content that would otherwise be cached across multiple external resolvers. When a consolidated cache is in front of external resolvers (each with their own cache), it can produce a much higher cache hit percentage.

F5 Networks recommends that you configure the BIG-IP system to forward queries, which cannot be answered from the cache, to a pool of local DNS servers rather than the local BIND instance because BIND performance is slower than using multiple external resolvers.

Note: For systems using the DNS Express feature, the BIG-IP system first processes the requests through DNS Express, and then caches the responses.
Important: The DNS Cache feature is available only when the BIG-IP system is licensed for DNS Services.

About the Resolver DNS cache

You can configure a resolver cache on the BIG-IP system to resolve DNS queries and cache the responses. The next time the system receives a query for a response that exists in the cache, the system returns the response from the cache. The resolver cache contains messages, resource records, and the nameservers the system queries to resolve DNS queries.

It is important for network architects to note that it is possible to configure the local BIND instance on the BIG-IP system to act as an external DNS resolver. However, F5 Networks does not recommend this approach, because the performance of BIND is slower than using a resolver cache.

Important: The DNS Cache feature is available only when the BIG-IP system is licensed for DNS Services.

About the Validating Resolver DNS cache

You can configure a validating resolver cache on the BIG-IP system to recursively query public DNS servers, validate the identity of the DNS server sending the responses, and then cache the responses. The next time the system receives a query for a response that exists in the cache, the system returns the DNSSEC-compliant response from the cache. The validating resolver cache contains messages, resource records, the nameservers the system queries to resolve DNS queries, and DNSSEC keys.

Using the validating resolver cache, the BIG-IP system mitigates cache poisoning by validating DNS responses using DNSSEC validation. This is important, because attackers can attempt to populate a DNS cache with erroneous data that redirects clients to fake web sites, or downloads malware and viruses to client computers. When an authoritative server signs a DNS response, the validating resolver verifies the data before entering the data into the cache. Additionally, the validating resolver cache includes a built-in filter and detection mechanism that rejects unsolicited DNS responses.

Important: The DNS Cache feature is available only when the BIG-IP system is licensed for DNS Services.

Configuring DNS cache global settings

Configure the global settings on the BIG-IP system to specify how the system manages the DNS caches you create.
  1. On the Main tab, click System > Configuration > Local Traffic > DNS. The DNS Local Traffic configuration screen opens.
  2. In the Minimum TTL field, type the minimum number of seconds you want the system to cache DNS resource records.
    Note: When you configure this setting the system can cache resource records longer than the owner of the records intended.
  3. In the Maximum TTL field, type the number of seconds after which you want the system to re-query for resource records.
    Note: This setting allows the system to re-query for resource records sooner than the owner of the records intended.
  4. In the EDNS Buffer Size field, type the number of bytes you want the system to advertise as the EDNS buffer size in UDP queries. The default value of 4096 bytes is the default value for ENDS0.
  5. Click Update.
After you configure the DNS global settings, create at least one DNS cache.

Overview: Improving DNS performance by caching responses from external resolvers

You can configure a transparent cache on the BIG-IP system to use external DNS resolvers to resolve queries, and then cache the responses from the resolvers. The next time the system receives a query for a response that exists in the cache, the system immediately returns the response from the cache. The transparent cache contains messages and resource records.

A transparent cache in the BIG-IP system consolidates content that would otherwise be cached across multiple external resolvers. When a consolidated cache is in front of external resolvers (each with their own cache), it can produce a much higher cache hit percentage.

F5 Networks recommends that you configure the BIG-IP system to forward queries, which cannot be answered from the cache, to a pool of local DNS servers rather than the local BIND instance because BIND performance is slower than using multiple external resolvers.

Note: For systems using the DNS Express feature, the BIG-IP system first processes the requests through DNS Express, and then caches the responses.
Important: The DNS Cache feature is available only when the BIG-IP system is licensed for DNS Services.
BIG-IP system using transparent cache BIG-IP system using transparent cache

Task Summary

Creating a transparent DNS cache

Ensure that the BIG-IP system is licensed for DNS Services.
Create a transparent cache on the BIG-IP system when you want the system to cache DNS responses from external DNS resolvers.
  1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List. The DNS Cache List screen opens.
  2. Click Create. The New DNS Cache screen opens.
  3. In the Name field, type a name for the cache.
  4. From the Resolver Type list, select Transparent.
  5. Click Finished.
Associate the DNS cache with a custom DNS profile.

Creating a custom DNS profile for transparent DNS caching

Ensure that at least one transparent cache exists on the BIG-IP system.
You can create a custom DNS profile to configure the BIG-IP system to cache responses to DNS queries.
  1. On the Main tab, click Local Traffic > Profiles > Services > DNS. The DNS profile list screen opens.
  2. Click Create. The New DNS Profile screen opens.
  3. In the Name field, type a unique name for the profile.
  4. In the Parent Profile list, accept the default dns profile.
  5. Select the Custom check box.
  6. From the Use BIND Server on BIG-IP list, select Disabled.
  7. From the DNS Cache list, select Enabled. When you enable the DNS Cache option, you must also select a DNS cache from the DNS Cache Name list.
  8. From the DNS Cache Name list, select the DNS cache that you want to associate with this profile. You can associate a DNS cache with a profile, even when the DNS Cache option, is Disabled. Use this option to enable and disable the cache for debugging purposes.
  9. Click Finished.
Assign the custom DNS profile to the virtual server that handles the DNS traffic from which you want to cache responses.

Assigning a custom DNS profile to an LTM virtual server

Ensure that at least one custom DNS profile that is configured for DNS caching exists on the BIG-IP system.
Assign a custom DNS profile to a virtual server when you want the BIG-IP system to perform DNS caching on traffic that the virtual server handles.
Note: This task applies only to LTM-provisioned systems.
  1. On the Main tab, click Local Traffic > Virtual Servers. The Virtual Server List screen opens.
  2. Click the name of the virtual server you want to modify.
  3. From the Configuration list, select Advanced.
  4. From the DNS Profile list, select the custom DNS profile you created.
  5. Click Update to save the changes.
The responses to DNS queries handled by this virtual server are cached on the BIG-IP system.

Assigning a custom DNS profile to a GTM listener

Ensure that at least one custom DNS profile that is configured for DNS caching exists on the BIG-IP system.
Assign a custom DNS profile to a listener when you want the BIG-IP system to perform DNS caching on traffic that the listener handles.
Note: This task applies only to GTM-provisioned systems.
  1. On the Main tab, click Global Traffic > Listeners. The Listeners List screen opens.
  2. Click the name of the listener you want to modify.
  3. From the DNS Profile list, select a custom DNS profile configured for DNS caching.
  4. Click Update.

Creating a custom DNS monitor

Create a custom DNS monitor to send DNS requests, generated using the settings you specify, to a pool of DNS servers and validate the DNS responses.
Important: When defining values for custom monitors, make sure you avoid using any values that are on the list of reserved keywords. For more information, see solution number 3653 (for version 9.0 systems and later) on the AskF5 technical support web site.
  1. On the Main tab, click Local Traffic > Monitors. The Monitor List screen opens.
  2. Click Create. The New Monitor screen opens.
  3. Type a name for the monitor in the Name field.
  4. From the Type list, select DNS.
  5. In the Query Name field, type the domain name that you want the monitor to query.
  6. From the Configuration list, select Advanced. This selection makes it possible for you to modify additional default settings.
  7. Configure settings based on your network requirements.
  8. Click Finished.

Creating a pool of local DNS servers

Ensure that at least one custom DNS monitor exists on the BIG-IP system. Gather the IP addresses of the DNS servers that you want to include in a pool to which the BIG-IP system load balances DNS traffic.
Create a pool of local DNS servers when you want to load balance DNS requests to back end DNS servers.
  1. On the Main tab, click Local Traffic > Pools. The Pool List screen opens.
  2. Click Create. The New Pool screen opens.
  3. In the Name field, type a unique name for the pool.
  4. For the Health Monitors setting, from the Available list, select the custom DNS monitor you created, and click << to move the monitor to the Active list.
  5. Using the New Members setting, add each resource that you want to include in the pool:
    1. Type an IP address in the Address field.
    2. Type a port number in the Service Port field, or select a service name from the list.
    3. To specify a priority group, type a priority number in the Priority Group Activation field.
    4. Click Add.
  6. Click Finished.

Determining DNS cache performance

Ensure that you have created a DNS cache and associated it with a DNS profile, and have assigned the profile to either an LTM virtual server or a GTM listener.
You can view statistics to determine how well a DNS cache on the BIG-IP system is performing.
  1. On the Main tab, click Statistics > Module Statistics > Local Traffic. The Local Traffic statistics screen opens.
  2. From the Statistics Type list, select DNS Cache.
  3. In the Details column for a cache, click View, to display detailed information about the cache.
  4. To return to the Local Traffic Statistics screen, click the Back button.

Viewing records in a DNS cache

You can view records in a DNS cache to determine how well a specific cache on the BIG-IP system is performing.
  1. Log in to the command-line interface of the BIG-IP system.
  2. At the BASH prompt, type the command: tmsh
  3. At the tmsh prompt, type the command: show ltm dns cache records rrset cache <cache name> For example, the command: show ltm dns cache records rrset cache my_transparent_cache, displays the resource records in the cache named my_transparent_cache.

Viewing DNS cache statistics using tmsh

You can view DNS cache statistics using tmsh to determine how well a specific cache on the BIG-IP system is performing.
  1. Log in to the command-line interface of the BIG-IP system.
  2. At the BASH prompt, type tmsh.
  3. At the tmsh prompt, type show ltm dns cache, and press Enter. Statistics for all of the DNS caches on the BIG-IP system display.
  4. At the tmsh prompt, type show ltm dns cache <cache-type>, and press Enter. For example, the command sequence show ltm dns cache transparent, displays statistics for each of the transparent caches on the system.
  5. At the tmsh prompt, type show ltm dns cache <cache type> <cache name>, and press Enter. For example, the command sequence, show ltm dns cache transparent my_t1, displays statistics for the transparent cache on the system named my_t1.

Managing transparent cache size

Determine the amount of memory the BIG-IP system has and how much of that memory you want to commit to DNS caching. View the statistics for a cache to determine how well the cache is working.
You can change the size of a DNS cache to fix cache performance issues.
  1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List. The DNS Cache List screen opens.
  2. Click the name of the cache you want to modify. The properties screen opens.
  3. In the Message Cache Size field, type the maximum size in bytes for the DNS message cache. The BIG-IP system caches the messages in a DNS response in the message cache. A higher maximum size makes it possible for more DNS responses to be cached and increases the cache hit percentage. A lower maximum size forces earlier eviction of cached content, but can lower the cache hit percentage.
    Important: When you change the value of the Message Cache Size, the records in the message cache are automatically removed. If you do not want to clear the message cache, do not change the value of this parameter.
  4. In the Resource Record Cache Size field, type the maximum size in bytes for the DNS resource record cache. The BIG-IP system caches the supporting records in a DNS response in the Resource Record cache. A higher maximum size makes it possible for more DNS responses to be cached and increases the cache hit percentage. A lower maximum size forces earlier eviction of cached content, but can lower the cache hit percentage.
    Warning: When you change the value of the Resource Record Cache Size, the records in the resource record cache are automatically removed from the cache. If you do not want to clear the resource record cache, do not change the value of this parameter.
  5. Click Finished.

Clearing a DNS cache

You can clear all records from a specific DNS cache on the BIG-IP system.
  1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List. The DNS Cache List screen opens.
  2. On the menu bar, click Statistics. The Local Traffic Statistics screen opens.
  3. Select the check box next to the cache you want to clear, and then click Clear Cache.

Clearing specific records from a DNS cache

You can clear specific records from a DNS cache using tmsh. For example, you can delete all RRSET records or only the A records in the specified cache.
Tip: In tmsh, you can use the command completion feature to discover the types of records that are available for deletion.
  1. Log in to the command-line interface of the BIG-IP system.
  2. At the BASH prompt, type the command: tmsh
  3. At the tmsh prompt, to navigate to the directory that contains the DNS cache records, type the command: ltm dns cache records
  4. To delete specific DNS cache records, type a variation of this command: delete <cache-type> type <record-type> cache <cache-name> For example, the command delete rrset type a cache my_resolver_cache, deletes the A records from the resource record cache of the resolver cache named my_resolver_cache.

Implementation result

You now have an implementation in which the BIG-IP system caches DNS responses from external DNS resolvers, and answers queries for a cached response. Additionally, the system forwards DNS queries that cannot be answered from the cache to a pool of local DNS servers.

Overview: Improving DNS performance by resolving queries and caching responses

You can configure a resolver cache on the BIG-IP system to resolve DNS queries and cache the responses. The next time the system receives a query for a response that exists in the cache, the system returns the response from the cache. The resolver cache contains messages, resource records, and the nameservers the system queries to resolve DNS queries.

Important: The DNS Cache feature is available only when the BIG-IP system is licensed for DNS Services.
BIG-IP system using resolver cache BIG-IP system using resolver cache

Task Summary

Creating a resolver DNS cache

Ensure that the BIG-IP system is licensed for DNS Services.
Create a resolver cache on the BIG-IP system when you want the system to resolve DNS queries and cache responses.
  1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List. The DNS Cache List screen opens.
  2. Click Create. The New DNS Cache screen opens.
  3. In the Name field, type a name for the cache.
  4. From the Resolver Type list, select Resolver.
  5. Click Finished.
Associate the DNS cache with a custom DNS profile.

Creating a custom DNS profile for DNS resolving and caching

Ensure that at least one DNS cache exists on the BIG-IP system.
You can create a custom DNS profile to configure the BIG-IP system to cache responses to DNS connection requests.
  1. On the Main tab, click Local Traffic > Profiles > Services > DNS. The DNS profile list screen opens.
  2. Click Create. The New DNS Profile screen opens.
  3. In the Name field, type a unique name for the profile.
  4. Select the Custom check box.
  5. From the Use BIND Server on BIG-IP list, select Disabled.
  6. From the DNS Cache list, select Enabled. When you enable the DNS Cache option, you must also select a DNS cache from the DNS Cache Name list.
  7. From the DNS Cache Name list, select the DNS cache that you want to associate with this profile. You can associate a DNS cache with a profile, even when the DNS Cache option, is Disabled. Use this option to enable and disable the cache for debugging purposes.
  8. Click Finished.
Assign the custom DNS profile to the virtual server handling the DNS traffic, which includes the responses to queries that you want to cache.

Determining DNS cache performance

Ensure that you have created a DNS cache and associated it with a DNS profile, and have assigned the profile to either an LTM virtual server or a GTM listener.
You can view statistics to determine how well a DNS cache on the BIG-IP system is performing.
  1. On the Main tab, click Statistics > Module Statistics > Local Traffic. The Local Traffic statistics screen opens.
  2. From the Statistics Type list, select DNS Cache.
  3. In the Details column for a cache, click View, to display detailed information about the cache.
  4. To return to the Local Traffic Statistics screen, click the Back button.

Viewing records in a DNS cache

You can view records in a DNS cache to determine how well a specific cache on the BIG-IP system is performing.
  1. Log in to the command-line interface of the BIG-IP system.
  2. At the BASH prompt, type the command: tmsh
  3. At the tmsh prompt, type the command: show ltm dns cache records rrset cache <cache name> For example, the command: show ltm dns cache records rrset cache my_transparent_cache, displays the resource records in the cache named my_transparent_cache.

Viewing DNS cache statistics using tmsh

You can view DNS cache statistics using tmsh to determine how well a specific cache on the BIG-IP system is performing.
  1. Log in to the command-line interface of the BIG-IP system.
  2. At the BASH prompt, type tmsh.
  3. At the tmsh prompt, type show ltm dns cache, and press Enter. Statistics for all of the DNS caches on the BIG-IP system display.
  4. At the tmsh prompt, type show ltm dns cache <cache-type>, and press Enter. For example, the command sequence show ltm dns cache transparent, displays statistics for each of the transparent caches on the system.
  5. At the tmsh prompt, type show ltm dns cache <cache type> <cache name>, and press Enter. For example, the command sequence, show ltm dns cache transparent my_t1, displays statistics for the transparent cache on the system named my_t1.

Managing cache size

Determine the amount of memory the BIG-IP system has and how much you want to commit to DNS caching. View the statistics for a cache to determine how well the cache is working.
You can change the size of a DNS cache to fix cache performance issues.
  1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List. The DNS Cache List screen opens.
  2. Click the name of the cache you want to modify. The properties screen opens.
  3. In the Message Cache Size field, type the maximum size in bytes for the DNS message cache. The BIG-IP system caches the messages in a DNS response in the message cache. A higher maximum size makes it possible for more DNS responses to be cached and increases the cache hit percentage. A lower maximum size forces earlier eviction of cached content, but can lower the cache hit percentage.
    Important: When you change the value of the Message Cache Size, the records in the message cache are automatically removed. If you do not want to clear the message cache, do not change the value of this parameter.
  4. In the Resource Record Cache Size field, type the maximum size in bytes for the DNS resource record cache. The BIG-IP system caches the supporting records in a DNS response in the Resource Record cache. A higher maximum size makes it possible for more DNS responses to be cached and increases the cache hit percentage. A lower maximum size forces earlier eviction of cached content, but can lower the cache hit percentage.
    Warning: When you change the value of the Resource Record Cache Size, the records in the resource record cache are automatically removed from the cache. If you do not want to clear the resource record cache, do not change the value of this parameter.
  5. In the Nameserver Cache Count field, type the maximum number of DNS nameservers for which the BIG-IP system caches connection and capability data.
    Important: When you change the value of the Nameserver Cache Count, the records in the nameserver cache are automatically removed from the cache. If you do not want to clear the nameserver cache, do not change the value of this parameter.
  6. In the Unsolicited Reply Threshold field, change the default value if you are using the BIG-IP system to monitor for unsolicited replies using SNMP. The system always rejects unsolicited replies. The default value of 0 (off) indicates the system does not generate SNMP traps or log messages when rejecting unsolicited replies. Changing the default value alerts you to a potential security attack, such as cache poisoning or DOS. For example, if you specify 1,000,000 unsolicited replies, each time the system receives 1,000,000 unsolicited replies, it generates an SNMP trap and log message.
  7. Click Update.

Clearing a DNS cache

You can clear all records from a specific DNS cache on the BIG-IP system.
  1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List. The DNS Cache List screen opens.
  2. On the menu bar, click Statistics. The Local Traffic Statistics screen opens.
  3. Select the check box next to the cache you want to clear, and then click Clear Cache.

Clearing specific records from a DNS cache

You can clear specific records from a DNS cache using tmsh. For example, you can delete all RRSET records or only the A records in the specified cache.
Tip: In tmsh, you can use the command completion feature to discover the types of records that are available for deletion.
  1. Log in to the command-line interface of the BIG-IP system.
  2. At the BASH prompt, type the command: tmsh
  3. At the tmsh prompt, to navigate to the directory that contains the DNS cache records, type the command: ltm dns cache records
  4. To delete specific DNS cache records, type a variation of this command: delete <cache-type> type <record-type> cache <cache-name> For example, the command delete rrset type a cache my_resolver_cache, deletes the A records from the resource record cache of the resolver cache named my_resolver_cache.

Implementation result

You now have an implementation in which the BIG-IP system acts as a DNS resolver, caches DNS responses, and answers queries for a cached response from the cache.

Overview: Resolving queries and caching validated responses

You can configure a validating resolver cache on the BIG-IP system to recursively query public DNS servers, validate the identity of the DNS server sending the responses, and then cache the responses. The next time the system receives a query for a response that exists in the cache, the system returns the DNSSEC-compliant response from the cache. The validating resolver cache contains messages, resource records, the nameservers the system queries to resolve DNS queries, and DNSSEC keys.

Using the validating resolver cache, the BIG-IP system mitigates cache poisoning by validating DNS responses using DNSSEC validation. This is important, because attackers can attempt to populate a DNS cache with erroneous data that redirects clients to fake web sites, or downloads malware and viruses to client computers. When an authoritative server signs a DNS response, the validating resolver verifies the data before entering the data into the cache. Additionally, the validating resolver cache includes a built-in filter and detection mechanism that rejects unsolicited DNS responses.

Important: The DNS Cache feature is available only when the BIG-IP system is licensed for DNS Services.
BIG-IP system using validating resolver cache BIG-IP system using validating resolver cache

Task Summary

Creating a validating resolver DNS cache

Ensure that the BIG-IP system is licensed for DNS Services.
Create a validating resolver cache on the BIG-IP system when you want the system to resolve DNS queries, use DNSSEC to validate the responses, and cache the responses.
  1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List. The DNS Cache List screen opens.
  2. Click Create. The New DNS Cache screen opens.
  3. In the Name field, type a name for the cache.
  4. From the Resolver Type list, select Validating Resolver.
  5. Click Finished.
Associate the DNS cache with a custom DNS profile.

About SEP records and DNSSEC

Each DNSSEC zone has a list of read-only Security Entry Point (SEP) records. The BIG-IP system creates these records automatically when you create a zone. These SEP records consist of Delegation Signer (DS) and DNSKey records.

Obtaining a trust or DLV anchor

Determine the signed zones from which you want to obtain a trust or DLV anchor.
If you want the BIG-IP system to cache a validated response for the signed zones, you need to obtain a trust or DLV anchor.
  1. On the Main tab, click Global Traffic > DNSSEC Zone List. The DNSSEC Zone List screen opens.
  2. Click the name of the DNSSEC zone for which you want to view or copy SEP records.
  3. On the menu bar, click SEP Records. The SEP records display for each generation of a key.
  4. Copy the trust or DLV anchor from the DNSKEY Record field.
Add the trust or DLV anchor to the validating cache resolver DNS cache.

Adding a trust anchor to a validating resolver DNS cache

Ensure that you have copied trust anchors for the signed zones that you want to add to the validating resolver.
A validating resolver uses at least one trust anchor to validate DNS responses.
  1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List. The DNS Cache List screen opens.
  2. Click the name of the cache you want to modify. The properties screen opens.
  3. On the menu bar, click Trust Anchors. The Trust Anchors screen opens.
  4. Click the Add button.
  5. In the Trust Anchor field, paste the trust anchor that you copied from the signed zone.
    Important: The trust anchor must be specified in a string format.
  6. Click Finished.
  7. For each additional trust anchor that you want to add to the validating resolver, repeat steps 4-6.
The validating resolver can now validate the content of DNS responses from the zones for which you added trust anchors.

Adding a DLV anchor to a validating resolver DNS cache

Ensure that you have copied a DLV anchor for the signed zones that you want to add to the validating resolver.
A validating resolver needs a DLV anchor to validate DNS responses from outside a zone.
  1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List. The DNS Cache List screen opens.
  2. Click the name of the cache you want to modify. The properties screen opens.
  3. On the menu bar, click DLV Anchors. The DLV Anchors screen opens.
  4. Click the Add button.
  5. In the DLV Anchor field, paste the DLV anchor that you want to add to the validating resolver.
    Important: The DLV anchor must be specified in a string format.
  6. Click Finished.
  7. For each additional DLV anchor that you want to add to the validating resolver, repeat steps 4-6.
The validating resolver can now validate the content of DNS responses from the zones for which you added DLV anchors.

Creating a custom DNS profile for validating resolver DNS caching

Ensure that at least one DNS cache exists on the BIG-IP system.
You can create a custom DNS profile to configure the BIG-IP system to cache responses to DNS connection requests.
  1. On the Main tab, click Local Traffic > Profiles > Services > DNS. The DNS profile list screen opens.
  2. Click Create. The New DNS Profile screen opens.
  3. In the Name field, type a unique name for the profile.
  4. In the Parent Profile list, accept the default dns profile.
  5. Select the Custom check box.
  6. From the Use BIND Server on BIG-IP list, select Disabled.
  7. From the DNS Cache list, select Enabled. When you enable the DNS Cache option, you must also select a DNS cache from the DNS Cache Name list.
  8. From the DNS Cache Name list, select the DNS cache that you want to associate with this profile. You can associate a DNS cache with a profile, even when the DNS Cache option, is Disabled. Use this option to enable and disable the cache for debugging purposes.
  9. Click Finished.
Assign the custom DNS profile to the virtual server that handles the DNS traffic that includes the responses to queries that you want to cache.

Determining DNS cache performance

Ensure that you have created a DNS cache and associated it with a DNS profile, and have assigned the profile to either an LTM virtual server or a GTM listener.
You can view statistics to determine how well a DNS cache on the BIG-IP system is performing.
  1. On the Main tab, click Statistics > Module Statistics > Local Traffic. The Local Traffic statistics screen opens.
  2. From the Statistics Type list, select DNS Cache.
  3. In the Details column for a cache, click View, to display detailed information about the cache.
  4. To return to the Local Traffic Statistics screen, click the Back button.

Viewing records in a DNS cache

You can view records in a DNS cache to determine how well a specific cache on the BIG-IP system is performing.
  1. Log in to the command-line interface of the BIG-IP system.
  2. At the BASH prompt, type the command: tmsh
  3. At the tmsh prompt, type the command: show ltm dns cache records rrset cache <cache name> For example, the command: show ltm dns cache records rrset cache my_transparent_cache, displays the resource records in the cache named my_transparent_cache.

Viewing DNS cache statistics using tmsh

You can view DNS cache statistics using tmsh to determine how well a specific cache on the BIG-IP system is performing.
  1. Log in to the command-line interface of the BIG-IP system.
  2. At the BASH prompt, type tmsh.
  3. At the tmsh prompt, type show ltm dns cache, and press Enter. Statistics for all of the DNS caches on the BIG-IP system display.
  4. At the tmsh prompt, type show ltm dns cache <cache-type>, and press Enter. For example, the command sequence show ltm dns cache transparent, displays statistics for each of the transparent caches on the system.
  5. At the tmsh prompt, type show ltm dns cache <cache type> <cache name>, and press Enter. For example, the command sequence, show ltm dns cache transparent my_t1, displays statistics for the transparent cache on the system named my_t1.

Managing cache size

Determine the amount of memory the BIG-IP system has and how much you want to commit to DNS caching. View the statistics for a cache to determine how well the cache is working.
You can change the size of a DNS cache to fix cache performance issues.
  1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List. The DNS Cache List screen opens.
  2. Click the name of the cache you want to modify. The properties screen opens.
  3. In the Message Cache Size field, type the maximum size in bytes for the DNS message cache. The BIG-IP system caches the messages in a DNS response in the message cache. A higher maximum size makes it possible for more DNS responses to be cached and increases the cache hit percentage. A lower maximum size forces earlier eviction of cached content, but can lower the cache hit percentage.
    Important: When you change the value of the Message Cache Size, the records in the message cache are automatically removed. If you do not want to clear the message cache, do not change the value of this parameter.
  4. In the Resource Record Cache Size field, type the maximum size in bytes for the DNS resource record cache. The BIG-IP system caches the supporting records in a DNS response in the Resource Record cache. A higher maximum size makes it possible for more DNS responses to be cached and increases the cache hit percentage. A lower maximum size forces earlier eviction of cached content, but can lower the cache hit percentage.
    Warning: When you change the value of the Resource Record Cache Size, the records in the resource record cache are automatically removed from the cache. If you do not want to clear the resource record cache, do not change the value of this parameter.
  5. In the Nameserver Cache Count field, type the maximum number of DNS nameservers for which the BIG-IP system caches connection and capability data.
    Important: When you change the value of the Nameserver Cache Count, the records in the nameserver cache are automatically removed from the cache. If you do not want to clear the nameserver cache, do not change the value of this parameter.
  6. In the Unsolicited Reply Threshold field, change the default value if you are using the BIG-IP system to monitor for unsolicited replies using SNMP. The system always rejects unsolicited replies. The default value of 0 (off) indicates the system does not generate SNMP traps or log messages when rejecting unsolicited replies. Changing the default value alerts you to a potential security attack, such as cache poisoning or DOS. For example, if you specify 1,000,000 unsolicited replies, each time the system receives 1,000,000 unsolicited replies, it generates an SNMP trap and log message.
  7. Click Update.

Clearing a DNS cache

You can clear all records from a specific DNS cache on the BIG-IP system.
  1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List. The DNS Cache List screen opens.
  2. On the menu bar, click Statistics. The Local Traffic Statistics screen opens.
  3. Select the check box next to the cache you want to clear, and then click Clear Cache.

Clearing specific records from a DNS cache

You can clear specific records from a DNS cache using tmsh. For example, you can delete all RRSET records or only the A records in the specified cache.
Tip: In tmsh, you can use the command completion feature to discover the types of records that are available for deletion.
  1. Log in to the command-line interface of the BIG-IP system.
  2. At the BASH prompt, type the command: tmsh
  3. At the tmsh prompt, to navigate to the directory that contains the DNS cache records, type the command: ltm dns cache records
  4. To delete specific DNS cache records, type a variation of this command: delete <cache-type> type <record-type> cache <cache-name> For example, the command delete rrset type a cache my_resolver_cache, deletes the A records from the resource record cache of the resolver cache named my_resolver_cache.

Implementation result

You now have an implementation in which the BIG-IP system acts as a DNS resolver, verifies the validity of the responses, caches DNSSEC-compliant responses, and answers queries for a cached response with a DNSSEC-compliant response from the cache.

Overview: Customizing a DNS cache

You can customize a DNS cache on the BIG-IP system to meet specific network needs by changing the default values on the DNS cache settings.

Configuring a DNS cache to answer queries for local zones

You can configure a DNS cache on the BIG-IP system to answer client requests for local zones.
  1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List. The DNS Cache List screen opens.
  2. Click the name of the cache you want to modify. The properties screen opens.
  3. Select the Enabled check box for the Answer Default Zones setting, when you want the BIG-IP system to answer queries for the default zones: localhost, reverse 127.0.0.1 and ::1, and AS112 zones.
  4. Click Update.

Configuring a DNS cache to use specific root nameservers

You can configure a resolver or validating resolver DNS cache on the BIG-IP system to use a specific server as an authoritative nameserver for the DNS root nameservers.
  1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List. The DNS Cache List screen opens.
  2. Click the name of the cache you want to modify. The properties screen opens.
  3. In the Root Hints area, in the IP address field, type the IP address of a DNS server that the system considers authoritative for the DNS root nameservers, and then click Add.
    CAUTION:
    By default, the system uses the DNS root nameservers published by InterNIC. When you add DNS root nameservers, the BIG-IP system no longer uses the default nameservers published by InterNIC, but uses the nameservers you add as authoritative for the DNS root nameservers.
    Based on your network configuration, add IPv4 or IPv6 addresses or both.
  4. Click Update.

Configuring a DNS cache alert for cache poisoning

You can configure a resolver or validating resolver DNS cache on the BIG-IP system to generate SNMP alerts and log messages when the cache receives unsolicited replies. This is helpful as an alert to a potential security attack, such as cache poisoning or DDoS.
  1. On the Main tab, click Local Traffic > DNS Caches > DNS Cache List. The DNS Cache List screen opens.
  2. Click the name of the cache you want to modify. The properties screen opens.
  3. In the Unsolicited Reply Threshold field, change the default value if you are using the BIG-IP system to monitor for unsolicited replies using SNMP. The system always rejects unsolicited replies. The default value of 0 (off) indicates the system does not generate SNMP traps or log messages when rejecting unsolicited replies. Changing the default value alerts you to a potential security attack, such as cache poisoning or DOS. For example, if you specify 1,000,000 unsolicited replies, each time the system receives 1,000,000 unsolicited replies, it generates an SNMP trap and log message.
  4. Click Update.
Table of Contents   |   << Previous Chapter   |   Next Chapter >>

Was this resource helpful in solving your issue?




NOTE: Please do not provide personal information.



Incorrect answer. Please try again: Please enter the words to the right: Please enter the numbers you hear:

Additional Comments (optional)