For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Techgeeeg_28888's avatar
Techgeeeg_28888
Icon for Nimbostratus rankNimbostratus
Jan 03, 2013

DNS Query Flow

Hi Everyone,   I have a small query realted to DNS query and how GTM works.     I have GTM configured with 2 ISP links and acts as DNS. Now i need to know the following     1) A cl...
config
design
Techgeeeg_28888's avatar
Techgeeeg_28888
Icon for Nimbostratus rankNimbostratus
Aug 10, 2015

Hi Gregory,

 

Thanks for the input i do agree to your point that the traffic processed by LTM is far more than what is processed by GTM but in my above question I am only talking about GTM not LTM..... as per my understanding BIG-IP with only GTM module is not going to offer any protection against DDos it needs to have the AFM module and/or ASM module to be more robust towards providing the security layer against DDOs. So BIG-IP with only GTM module will get under attack for sure... unless we are playing with irule but even for that we have limit it can't be dynamic.

 

Regards,

 

Gregory_Thiell's avatar
Gregory_Thiell
Icon for Employee rankEmployee
Aug 11, 2015
Techgeeeg, You should treat legitimate traffic and bad traffic separately. You just jumped from one topic (controlling the TTL) to another (being attacked). These are two unrelated things. You understand that changing the TTL will not prevent you from being attacked. For the legitimate traffic, you might have a good reason not to compare LTM and GTM traffic while evaluating the bandwidth. For example, one connection is dedicated to DNS requests and there is no other traffic on the link (never seen that before, but why not). In all other cases, because you know that DNS will always be a tiny percentage of your actual traffic (HTTP), you don't need to worry about it too much. Now if you prefer, you can calculate the maximum number of DNS responses your bandwidth could handle... Take the average DNS packet size (it's usually about 100 Bytes = 800 bits). If your bandwidth is only 10 Mb/s, 10,000,000/800 = 12,500 DNS responses per second. If that's not enough, it means you need a bigger bandwidth. Regarding bad traffic, implementing only the GTM module can already help you protect against DDoS attacks. Implementing DNS Express is a good example (DNS Express is a GTM feature that is also available with LTM). Now if you want more control then yes, you should provision and configure AFM. As for ASM, it doesn't do anything with DNS in its current version.