Configuring listener IP for TCP
I am preparing for the 302 exam and I ran into this " DNS zone transfers use TCP port 53. If you do not configure a listener for TCP the client might receive the error: connection refused or TCP RSTs."
Why should I configure listener for TCP, besides for zone transfer ?
If I am not using zone transfer, is UDP listener enough for answering DNS quesries ?
What are the scenarios client might recieve connection refused from the Big-IP DNS ?
UPD is limited to 512 bytes. Some of the newer record types might contain messages that exceed the 512 byte limit and use TCP as fallback.
- See: RFC 5966 - DNS Transport over TCP - Implementation Requirements
- And also: K91537308: Overview of the truncating rule when DNS response size is over 512 Bytes
I never tried to pass the 302 exam. However, I am 100% it is for BIG-IP 12.1. You are looking at an article that is relevant for 14.1 to 16.1. Make sure you are looking the relevant sources (K29900360: F5 certification | Exams and blueprints).
I will try to answer your second question too:
This solution (K14510: Overview of DNS query processing on BIG-IP systems) explains in which order the BIG-IP processes DNS requests and how to configure Unhandled Query Actions. One setting for unhandled queries is Reject.
- Use the Reject setting to return a REFUSED status for the DNS query.
DISCLAIMER: I admit that I am not an expert for BIG-IP DNS. Maybe this is not the only correct answer to your question.