Forum Discussion
Eduardo_Vieira
Altocumulus
AltocumulusDeliver different ips having the same dns zone name but in different views
Good morning gentlemen.
I have an interesting case to be solved, the scenario is:
I have 2 listening and I have two views, one internal and one external,
however the name of the zones are the same, for example xpto.com.br,
I need that when a request is made to test.xpto.com.br to listening 1 ( 10.10.10.10) it delivers the ip of the internal view,
and when a request is made to listening 2 (20.20.20.20) it delivers the ip of the external view.
thanks for all the help in advance.
- G-Rob
Employee
You can achieve this in the BIG-IP using split DNS: https://my.f5.com/manage/s/article/K14421
Eduardo_VieiraHi Rob, thanks for trying to help me.
There is a big problem, my origin ips are all from the 10.0.0.0/8 network.That way when I get to the big dns I can't split by source IP.
Hence the idea of using one listening to deliver the internal zone, and another to deliver the external zone. That way, whenever the query goes to listening 10.10.10.10, it delivers the internal resolution, and if it goes to 20.20.20.20, it delivers the external one.
additiondakku01Nimbostratus
DNS doctoring which changes the destination in the DNS response from the mapped IP to the real IP so that when people outside of your organization make the query they are still provided the public IP and everyone internally receive the real IP which is usually a private IP.
- Eduardo_Vieira
I'll check this information, but I think the scenario was poorly explained on my part, sorry, I'll try again.
I have a bigip dns configured with two views, one internal and the other external, in the view configuration it has precedence, where when performing a query in a listening, say 10.10.10.10 it will search in the internal view and if not find it, do it on the outside. And right there I find the problem, I need to make the IP 10.10.10.10 query only an internal view. This tense scenario 2 listening would be basically the same, where 20.20.20.20 would query only the external view.
I hope the situation is clearer.
- Paulius
MVP
Eduardo_Vieira You might be able to use the following article to help out with this.
https://clouddocs.f5.com/api/irules/DNS_REQUEST.html
The better alternative here would be to have the GTM listening on only the 20.20.20.20 and then configure your perimeter firewall to perform DNS doctoring which changes the destination in the DNS response from the mapped IP to the real IP so that when people outside of your organization make the query they are still provided the public IP and everyone internally receive the real IP which is usually a private IP.
- Eduardo_Vieira
But in that case I still have the same problem?
At this point I will have a listening, in this case the 20.20.20.20 and requests will arrive at it and it will respond only to one zone right? So I understand that the problem is the same.
The idea of having 2 listening would be for each one to deliver the resolution of a different view, in this case one delivers INTERNAL and the other EXTERNAL.
- Paulius
Eduardo_Vieira If your edge firewall has DNS doctoring then you wouldn't have the same issue because lets say you have a NAT that is 20.20.30.10 that nats to private IP 10.10.30.10 with DNS doctoring. If an internal client received any DNS response from anywhere that the response has to pass back through your firewall and the destination of that record is 20.20.30.10 the firewall would change the response to now use 10.10.30.10 which would then send you to the internal destination rather than the public destination.
