For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Techgeeeg_28888's avatar
Techgeeeg_28888
Icon for Nimbostratus rankNimbostratus
Apr 28, 2014

security of Dns query

Hi Everyone,

 

I am using F5-LC in my network n my public DNS is configured to query F5-LC for the public IP address of the queries I need to know how can i secure the communication between my public DNS and F5-LC to avoid any one from tempering the response n causing DNS attack

 

Any help pls with document or response is highly appreciated.

 

Regards,

 

8 Replies

  • you can't, you don't control the public server. so anyone could change something.

     

    if it is just the traffic you could look for a DNS provider that allows you to setup a VPN tunnel to there server.

     

  • You could use DNSSEC if your hosting provider supports it. It requires an additional license though.

     

    http://www.f5.com/pdf/deployment-guides/gtm-dnssec-dg.pdf

     

  • Thanks Cory but also I want to know which portion of the DNS query will be secured, the situation is as follows,

     

    1. My public DNS is hosted inside my network. (So when a user's LDNS initially send's a query it comes tot his DNS server).

       

    2. As part of zone delegation the request from my Public DNS server is forwarded to LC so client LDNS query my LC.

       

    So can i secure both of the DNS levels?? and then the question comes how i mean is there any guide for it or an article.

     

  • If your hosting provider supports DNSSEC, and your public DNS server does as well, then you should be able to build the entire trust chain.

     

    DNSSEC doesn't necessarily 'secure' the DNS environment from an encryption standpoint like SSL does. It just provides a way of ensuring that the query a client issues is answered authoritatively by the proper DNS server and nothing is being changed along the communications path.

     

  • Thanks Cory.... is there any detailed guide from F5 or else for the implementation of the same which you have gone through ???

     

  • The deployment guide which I linked in my first response details what needs to be done at the GTM in order to enable DNSSEC. In our environment, our GTMs are authoritative for all of our domains. So our parent (which supports DNSSEC) points directly to our GTMs for authoritative responses, so our chain of trust is simpler. You have an added layer of complexity with your public DNS server.

     

  • Well yes i really have to search for the support of DNSSEC at all of these layers your case is really ideal where GTM is the authority for the complete domain.