For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Richard_H_12595's avatar
Richard_H_12595
Icon for Nimbostratus rankNimbostratus
Jun 09, 2014

GTM DNSSEC and dig

In my quest to work with dotgov to get DNSSEC enabled on the GTM (it shouldn't be this hard) the latest thing they are saying is that dig is not returning the DNSKEY records. The command they are us...
BIG-IP DNS
deployment
Richard_H_12595's avatar
Richard_H_12595
Icon for Nimbostratus rankNimbostratus
Jun 10, 2014

I double checked that and it doesn't look like that is affecting us. The 7k's have been running for upwards to a year and we only have a few thousand hits for destination zero and a handful of checksum ones. I also tested doing the dig ANY and it didn't increment the counters.

 

If I do this to a bind server configured with DNSSEC it works fine and returns the DNSKEY records but if I do it to a GTM configured with DNSSEC the ANY keyword doesn't return the DNSKEY records which really tells me it's something inside the GTM. We are on 11.4 in production and 11.4.1 in my lab and both do it but I have not tested it on 11.5 yet to see if the behavior is different there.