Unable to access virtual server over port 53

Question

I currently have virtual server set up a load balance across three DNS servers. If I issue command "nslookup www.google.com [IP of VS]" from a client machine I'm getting a DNS request time out error. I've verified that the vIP is reachable from the client and it's operational on the BIG-IP. The DNS servers are reachable on the BIG-IP as well and are passing the monitor associated with the pool.

greg_labelle · Answer

Can you post the configuration for the virtual server here?

sarah_258804 · Answer

{&nbsp;
  "name": "DNS-Internal-VS",&nbsp;
  "template": "appsvcs_integration_v1.0_001",&nbsp;
  "virtualServerReferences": [&nbsp;
    {&nbsp;
      "link": ""&nbsp;
    }&nbsp;
  ],&nbsp;
  "vars": {&nbsp;
    "extensions__Field1": "",&nbsp;
    "extensions__Field2": "",&nbsp;
    "extensions__Field3": "",&nbsp;
    "feature__easyASMPolicy": "disabled",&nbsp;
    "feature__easyL4Firewall": "auto",&nbsp;
    "feature__insertXForwardedFor": "auto",&nbsp;
    "feature__redirectToHTTPS": "auto",&nbsp;
    "feature__securityEnableHSTS": "disabled",&nbsp;
    "feature__sslEasyCipher": "disabled",&nbsp;
    "feature__statsHTTP": "auto",&nbsp;
    "feature__statsTLS": "auto",&nbsp;
    "iapp__appStats": "enabled",&nbsp;
    "iapp__mode": "auto",&nbsp;
    "iapp__routeDomain": "auto",&nbsp;
    "iapp__strictUpdates": "enabled",&nbsp;
    "pool__AdvOptions": "",&nbsp;
    "pool__Description": "pooldescr",&nbsp;
    "pool__LbMethod": "round-robin",&nbsp;
    "pool__MemberDefaultPort": "53",&nbsp;
    "pool__Monitor": "/Common/dns_53",&nbsp;
    "pool__Name": "DNS-Internal-Pool",&nbsp;
    "pool__addr": "10.251.12.30",&nbsp;
    "pool__mask": "255.255.255.255",&nbsp;
    "pool__port": "53",
    "vs__AdvOptions": "",&nbsp;
    "vs__AdvProfiles": "",  &nbsp;
    "vs__ConnectionLimit": "0",&nbsp;
    "vs__Description": "vsdescr",&nbsp;
    "vs__IpProtocol": "udp", &nbsp;
    "vs__Irules": "",&nbsp;
    "vs__Name": "",&nbsp;
    "vs__OptionConnectionMirroring": "disabled",&nbsp;
    "vs__OptionSourcePort": "preserve",&nbsp;
    "vs__ProfileAccess": "",&nbsp;
    "vs__ProfileAnalytics": "",&nbsp;
    "vs__ProfileClientProtocol": "/Common/udp_gtm_dns",  &nbsp;
    "vs__ProfileClientSSL": "",&nbsp;
    "vs__ProfileClientSSLAdvOptions": "",&nbsp;
    "vs__ProfileClientSSLCert": "",&nbsp;
    "vs__ProfileClientSSLChain": "",&nbsp;
    "vs__ProfileClientSSLCipherString": "",&nbsp;
    "vs__ProfileClientSSLKey": "",&nbsp;
    "vs__ProfileCompression": "",&nbsp;
    "vs__ProfileConnectivity": "",&nbsp;
    "vs__ProfileDefaultPersist": "",&nbsp;
    "vs__ProfileFallbackPersist": "",&nbsp;
    "vs__ProfileHTTP": "",&nbsp;
    "vs__ProfileOneConnect": "",&nbsp;
    "vs__ProfilePerRequest": "",&nbsp;
    "vs__ProfileRequestLogging": "",&nbsp;
    "vs__ProfileSecurityDoS": "",&nbsp;
    "vs__ProfileSecurityIPBlacklist": "none",&nbsp;
    "vs__ProfileSecurityLogProfiles": "",&nbsp;
    "vs__ProfileServerProtocol": "/Common/udp_gtm_dns",&nbsp;
    "vs__ProfileServerSSL": "",&nbsp;
    "vs__SNATConfig": "automap",&nbsp;
    "vs__SourceAddress": "0.0.0.0/0"&nbsp;
  },&nbsp;
  "tables": {&nbsp;
    "feature__easyL4FirewallBlacklist": {&nbsp;
      "columns": [&nbsp;
        "CIDRRange"&nbsp;
      ],&nbsp;
      "rows": [&nbsp;
        [&nbsp;
          ""&nbsp;
        ]&nbsp;
      ]&nbsp;
    },&nbsp;
    "feature__easyL4FirewallSourceList": {&nbsp;
      "columns": [&nbsp;
        "CIDRRange"&nbsp;
      ],&nbsp;
      "rows": [&nbsp;
        [ &nbsp;
          "0.0.0.0/0"&nbsp;
        ]&nbsp;
      ]&nbsp;
    },&nbsp;
    "pool__Members": {&nbsp;
      "columns": [&nbsp;
        "IPAddress",&nbsp;
        "Port",&nbsp;
        "ConnectionLimit",&nbsp;
        "Ratio",&nbsp;
        "State"&nbsp;
      ],&nbsp;
      "rows": [&nbsp;
        [&nbsp;
          "10.251.116.150",&nbsp;
          "53",&nbsp;
          "0",&nbsp;
          "1",&nbsp;
          "enabled"&nbsp;
        ],&nbsp;
        [&nbsp;
          "10.251.116.151",&nbsp;
          "53",&nbsp;
          "0",&nbsp;
          "1",&nbsp;
          "enabled"&nbsp;
        ],&nbsp;
        [&nbsp;
          "10.251.116.152", &nbsp;
          "53", &nbsp;
          "0",&nbsp;
          "1",&nbsp;
          "enabled"&nbsp;
        ],&nbsp;
        [ &nbsp;
          "10.251.116.153", &nbsp;
          "53", &nbsp;
          "0",&nbsp;
          "1", &nbsp;
          "enabled" &nbsp;
        ]&nbsp;
      ]&nbsp;
    }&nbsp;
  },&nbsp;
  "generation": 0,&nbsp;
  "lastUpdateMicros": 0, &nbsp;
  "selfLink": ""&nbsp;
}  &nbsp;

sarah_258804 · Answer

Configuration of application profile below.

greg_labelle_31 · Answer

I notice that your virtual server is setup for UDP.  When the response for a DNS query contains more records than can fit in a single UDP packet, it will leverage TCP instead to send the query.  Try resolving a simple query that has only one record to test the theory. If this is the case, you'll need to setup a second virtual server at the same address and port using the TCP protocol as well to support both paradigms.

sarah_258804 · Answer

I tried that and no dice. I have a ticket open for this issue and it was pointed out that I didn't have a "DNS Profile" assigned to this virtual server. I added the basic DNS profile and still no resolving ip addresses with the virtual server IP.

Forum Discussion

Unable to access virtual server over port 53

Recent Discussions

self-directed requests fail because of no certificate

Decode ObjectSID from Base64-encode string

iRule - Url rewrite and header replace and pool selection not working

ip x-forwarding

F5 ASM API-Protection Policy

Related Content

Restrict access to virtual server during specified time

Unable to Create UCS files

Virtual server and http pool not accessible

Virtual Server Cannot Access External Pool Members

Why my virtual server can't be accessed

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS