Forum Discussion

Harutyun's avatar
Harutyun
Icon for Nimbostratus rankNimbostratus
Mar 28, 2020

F5 DNS listener protection from DDOS and other attacks

We have F5 Big-IP VE with license GTM(DNS). I have configured gslb.example.com zone in ZoneRunner and delegate it in our external (ISP) DNS servers in order to our clients get information for zone gslb.example.com from our F5 big-IP VE. Notify, that there is a PaloAlto 3020 in front of F5 Big-IP VE.

How can I protect my DNS Listeners from DDOS and other attacks?

application delivery
BIG-IP DNS
security
VE GSLB DDOS
  • Samir's avatar
    Samir
    Icon for MVP rankMVP
    Apr 12, 2020

    Modern security device has the capabilities to protect ​network from attack such as DOS, DDOS, Syn flood etc. As you said palo alto is front then F5 DNS. So these devices has DDOS protection machanism. If possible add one more layer between palo alto n F5 DNS.

    ​

    Thanks​

  • Harutyun's avatar
    Harutyun
    Icon for Nimbostratus rankNimbostratus
    Apr 13, 2020

    Hi  . Thank you for your respond. What do you mean one more layer between PA and F5 DNS? Is there necessary to implement F5 AWAF with DNS?

    • Samir's avatar
      Samir
      Icon for MVP rankMVP
      Apr 13, 2020

      AWAF will not help here.you can add additional L3 layer(i.e firewall,etc)

      • Harutyun's avatar
        Harutyun
        Icon for Nimbostratus rankNimbostratus
        Apr 13, 2020

        We also have Cisco router(Nat, VPN, Acces Lists) in front of PA.