For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Thrillseeker_12's avatar
Thrillseeker_12
Icon for Cirrus rankCirrus
Jun 26, 2016

F5 BIGIP VE with Virtual Forwarding Server dropped some DNS requests...

Hi all,   Last week I had a very strange issue. We have an F5 VE LTM Active/Standby Cluster pair. The setup is running stable for more than 4 months now. In this environment the F5 VE acts as an d...
application delivery
LTM
Thrillseeker_12's avatar
Thrillseeker_12
Icon for Cirrus rankCirrus
Jun 27, 2016

Unfortunately I do not have a packet capture at the moment. Maybe I will find a service window this week to reproduce the issue.

At the moment 11.6 HF6 is installed on both F5 BIG-IP VE's.

The DNS requests in my tests where just normal "dig" commands with mx option like:

dig www.google.com mx

As I saw in the TCPDUMP's the requests where simple UDP/53 on the inner f5 interface. From 5 DNS requests (dig) 3 where answered correctly and 2 where not answered at all... After failover to the standby unit the DNS issue was gone...

The f5 gears are directly connected to the internet in our cloud. The only device between is the internet gw (cisco router) but there aren't any ACL's preventing DNS to change from UDP to TCP.