For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Alex_f5's avatar
Alex_f5
Icon for Altostratus rankAltostratus
Aug 28, 2020

GTM irule to log source IP address of DNS server querying a WIP and Answer back

hello folks, need some help to finish a GTM irule to log in console the source IP address of DNS servers querying my WIP, their location and the answer resolved by the GTM based on the WIP logic ...
application delivery
BIG-IP DNS
iRules
Alex_f5's avatar
Alex_f5
Icon for Altostratus rankAltostratus
Aug 28, 2020

Update: In case somebody else have the same problem, I found there is not a way to add DNS_RESPONSE in GTM irules to be applied on WIPs. The ultimate workaround is via an LTM irule applied on the listener, in that irule you define something like:

 

when DNS_RESPONSE {

if { [DNS::question name] equals "abcde.test.domain.com" } {

log local0. "QUERY from: [IP::remote_addr] - LOCATION: [whereis [IP::remote_addr]] - QUESTION: [DNS::question name], -TYPE [DNS::question type]", - ANSWER: [DNS::answer]"

 }

}

 

 

-alex.