GTM and Wide IPs

Here is what you can do.

Say that your DNS servers are authoritative for example.com domain and it answers for all queries for example.com domain. Say you need the GTM to hand out DNS requests for forward.example.com.

Create a new domain wip.example.com and make the GTM authoritative for this new domain (Create a new Zone record in Zonerunner for wip.example.com domain - This will create a new SOA record and a NS record on the GTM).

Create new CNAME entry for forward.example.com which points to forward.wip.example.com on the regular DNS.

forward.example.com CNAME forward.wip.example.com

Create a new WideIP on the GTM for forward.wip.example.com

At this point any DNS query for forward.example.com that a client asks for will eventually end up at the GTM.

What happens:

1. Client asks regular DNS for forward.example.com

    

2. DNS server has a CNAME pointing to forward.wip.example.com

    

3. DNS server knows that GTM is authoritative for the wip.example.com domain

    

4. DNS sends a request to the GTM for forward.wip.example.com

    

5. GTM responds back with the IP for forward.wip.example.com to the DNS server

    

6. DNS server responds back to the client with the IP address

    

Note: In this scenario the GTM is going to see the DNS server as the source of the DNS query and not the actual client machine.

Hi Bhanu,

Thanks for this. Very clear and concise. So the GTM would have to have an SOA and NS record for each domain it was responding for? I notice that when creating a wide ip the SOA and NS record gets setup automatically. But, If i am in a position where we have 100 FQDNS required for a specific customer (lets say forward.example.com, forward1.example.com, forward1.example1.com, forward.example1.com) i would like to use wildcards to ease administration. For the above perhaps i have tried to create a wide ip such as .example.com that would cover off each FQDN (or used wilcards in aliases). Is this possible? When i test with DIG (DIG @ forward.example1.com) i get a correct response as expected but if an actual DNS server makes the request it fails. It seems that using wildcards doesnt seem to create the SOA/NS records automatically and i assume that because we dont have an SOA/NS record for the domain in question the query from the DNS server fails as the GTM is not authoritative for the domain?

David,

Correct, when you create a wild card WIDE IP it will not create the SOA/NS records on the GTM. Once you create the SOA/NS records, the wild card WIDE IPs should work as expected.

If you configure the wild card WIDE IP as forward*.wip.example.com, the GTM will respond to forward2.wip.example.com, forward7.wip.example.com, etc...

http://support.f5.com/kb/en-us/products/lc_9_x/manuals/product/lc_config_10_2/lc_wideips.html

Thanks.

Thanks again......one confusing aspect is that docs suggest wide ips are separate from zonerunner files. But with the above in mind i dont see how the two are not related. For wide ips to work you need zonerunner entries even if you are not using full functionality of bind