For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

shashank_shetti's avatar
shashank_shetti
Icon for Nimbostratus rankNimbostratus
Feb 17, 2016

RESOLV::lookup hard coded DNS ip address - How to avoid hard coding in irule

Here is the my irule code in how I resolve the ip address of domain name

 

set dest [lindex [RESOLV::lookup @10.10.100.100 -a "someSite.net"] 0]

 

I do not want to hard code the dns ip address in the above code. IF I happen to remove it I am getting empty ip address while resolving to somesite.net.

 

I was in understanding that in the above code if I dont mention the dns ip then it should be looking at BIND Forwarder Server list for the dns.

 

System -> Configuration:Device:DNS

 

adding the dns entry in the following properties dns lookup server list bind forwarder server list

 

but it still doesnt work. Any help is appreciated.

 

application delivery
BIG-IP DNS
iRules

1 Reply

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Feb 18, 2016

    Hi Shashank shetti,

    you have to follow the workaround of SOL12224 (aka. 

    recursion yes
    ) to allow the iRule to use the local BIND to ask recursive DNS queries.

    https://support.f5.com/kb/en-us/solutions/public/12000/200/sol12224

    Note: Alternatively, you may want to hardcode a generic virtual server name (e.g. VS_EXT_DNS or DNS_INT_DNS) into your iRule and then use the names virtual servers to access some internal/external DNS pools. This technique allows you to still have flexibility in the case the DNS server pools members require changes, but also have the option to use different DNS server pools (Internal/External) to launch the query.

    Cheers, Kai