Forum Discussion
security of Dns query
Hi Everyone,
I am using F5-LC in my network n my public DNS is configured to query F5-LC for the public IP address of the queries I need to know how can i secure the communication between my public DNS and F5-LC to avoid any one from tempering the response n causing DNS attack
Any help pls with document or response is highly appreciated.
Regards,
8 Replies
- Techgeeeg
Nimbostratus
Any one plsssss
you can't, you don't control the public server. so anyone could change something.
if it is just the traffic you could look for a DNS provider that allows you to setup a VPN tunnel to there server.
- Cory_50405
Noctilucent
You could use DNSSEC if your hosting provider supports it. It requires an additional license though.
http://www.f5.com/pdf/deployment-guides/gtm-dnssec-dg.pdf
- Techgeeeg
Nimbostratus
Thanks Cory but also I want to know which portion of the DNS query will be secured, the situation is as follows,
-
My public DNS is hosted inside my network. (So when a user's LDNS initially send's a query it comes tot his DNS server).
-
As part of zone delegation the request from my Public DNS server is forwarded to LC so client LDNS query my LC.
So can i secure both of the DNS levels?? and then the question comes how i mean is there any guide for it or an article.
-
- Cory_50405
Noctilucent
If your hosting provider supports DNSSEC, and your public DNS server does as well, then you should be able to build the entire trust chain.
DNSSEC doesn't necessarily 'secure' the DNS environment from an encryption standpoint like SSL does. It just provides a way of ensuring that the query a client issues is answered authoritatively by the proper DNS server and nothing is being changed along the communications path.
- Techgeeeg
Nimbostratus
Thanks Cory.... is there any detailed guide from F5 or else for the implementation of the same which you have gone through ???
- Cory_50405
Noctilucent
The deployment guide which I linked in my first response details what needs to be done at the GTM in order to enable DNSSEC. In our environment, our GTMs are authoritative for all of our domains. So our parent (which supports DNSSEC) points directly to our GTMs for authoritative responses, so our chain of trust is simpler. You have an added layer of complexity with your public DNS server.
- Techgeeeg
Nimbostratus
Well yes i really have to search for the support of DNSSEC at all of these layers your case is really ideal where GTM is the authority for the complete domain.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com