Unable to access virtual server over port 53

Question

I currently have virtual server set up a load balance across three DNS servers. If I issue command "nslookup www.google.com [IP of VS]" from a client machine I'm getting a DNS request time out error. I've verified that the vIP is reachable from the client and it's operational on the BIG-IP. The DNS servers are reachable on the BIG-IP as well and are passing the monitor associated with the pool.

greg_labelle · Answer

Can you post the configuration for the virtual server here?

sarah_258804 · Answer

{&nbsp;
  "name": "DNS-Internal-VS",&nbsp;
  "template": "appsvcs_integration_v1.0_001",&nbsp;
  "virtualServerReferences": [&nbsp;
    {&nbsp;
      "link": ""&nbsp;
    }&nbsp;
  ],&nbsp;
  "vars": {&nbsp;
    "extensions__Field1": "",&nbsp;
    "extensions__Field2": "",&nbsp;
    "extensions__Field3": "",&nbsp;
    "feature__easyASMPolicy": "disabled",&nbsp;
    "feature__easyL4Firewall": "auto",&nbsp;
    "feature__insertXForwardedFor": "auto",&nbsp;
    "feature__redirectToHTTPS": "auto",&nbsp;
    "feature__securityEnableHSTS": "disabled",&nbsp;
    "feature__sslEasyCipher": "disabled",&nbsp;
    "feature__statsHTTP": "auto",&nbsp;
    "feature__statsTLS": "auto",&nbsp;
    "iapp__appStats": "enabled",&nbsp;
    "iapp__mode": "auto",&nbsp;
    "iapp__routeDomain": "auto",&nbsp;
    "iapp__strictUpdates": "enabled",&nbsp;
    "pool__AdvOptions": "",&nbsp;
    "pool__Description": "pooldescr",&nbsp;
    "pool__LbMethod": "round-robin",&nbsp;
    "pool__MemberDefaultPort": "53",&nbsp;
    "pool__Monitor": "/Common/dns_53",&nbsp;
    "pool__Name": "DNS-Internal-Pool",&nbsp;
    "pool__addr": "10.251.12.30",&nbsp;
    "pool__mask": "255.255.255.255",&nbsp;
    "pool__port": "53",
    "vs__AdvOptions": "",&nbsp;
    "vs__AdvProfiles": "",  &nbsp;
    "vs__ConnectionLimit": "0",&nbsp;
    "vs__Description": "vsdescr",&nbsp;
    "vs__IpProtocol": "udp", &nbsp;
    "vs__Irules": "",&nbsp;
    "vs__Name": "",&nbsp;
    "vs__OptionConnectionMirroring": "disabled",&nbsp;
    "vs__OptionSourcePort": "preserve",&nbsp;
    "vs__ProfileAccess": "",&nbsp;
    "vs__ProfileAnalytics": "",&nbsp;
    "vs__ProfileClientProtocol": "/Common/udp_gtm_dns",  &nbsp;
    "vs__ProfileClientSSL": "",&nbsp;
    "vs__ProfileClientSSLAdvOptions": "",&nbsp;
    "vs__ProfileClientSSLCert": "",&nbsp;
    "vs__ProfileClientSSLChain": "",&nbsp;
    "vs__ProfileClientSSLCipherString": "",&nbsp;
    "vs__ProfileClientSSLKey": "",&nbsp;
    "vs__ProfileCompression": "",&nbsp;
    "vs__ProfileConnectivity": "",&nbsp;
    "vs__ProfileDefaultPersist": "",&nbsp;
    "vs__ProfileFallbackPersist": "",&nbsp;
    "vs__ProfileHTTP": "",&nbsp;
    "vs__ProfileOneConnect": "",&nbsp;
    "vs__ProfilePerRequest": "",&nbsp;
    "vs__ProfileRequestLogging": "",&nbsp;
    "vs__ProfileSecurityDoS": "",&nbsp;
    "vs__ProfileSecurityIPBlacklist": "none",&nbsp;
    "vs__ProfileSecurityLogProfiles": "",&nbsp;
    "vs__ProfileServerProtocol": "/Common/udp_gtm_dns",&nbsp;
    "vs__ProfileServerSSL": "",&nbsp;
    "vs__SNATConfig": "automap",&nbsp;
    "vs__SourceAddress": "0.0.0.0/0"&nbsp;
  },&nbsp;
  "tables": {&nbsp;
    "feature__easyL4FirewallBlacklist": {&nbsp;
      "columns": [&nbsp;
        "CIDRRange"&nbsp;
      ],&nbsp;
      "rows": [&nbsp;
        [&nbsp;
          ""&nbsp;
        ]&nbsp;
      ]&nbsp;
    },&nbsp;
    "feature__easyL4FirewallSourceList": {&nbsp;
      "columns": [&nbsp;
        "CIDRRange"&nbsp;
      ],&nbsp;
      "rows": [&nbsp;
        [ &nbsp;
          "0.0.0.0/0"&nbsp;
        ]&nbsp;
      ]&nbsp;
    },&nbsp;
    "pool__Members": {&nbsp;
      "columns": [&nbsp;
        "IPAddress",&nbsp;
        "Port",&nbsp;
        "ConnectionLimit",&nbsp;
        "Ratio",&nbsp;
        "State"&nbsp;
      ],&nbsp;
      "rows": [&nbsp;
        [&nbsp;
          "10.251.116.150",&nbsp;
          "53",&nbsp;
          "0",&nbsp;
          "1",&nbsp;
          "enabled"&nbsp;
        ],&nbsp;
        [&nbsp;
          "10.251.116.151",&nbsp;
          "53",&nbsp;
          "0",&nbsp;
          "1",&nbsp;
          "enabled"&nbsp;
        ],&nbsp;
        [&nbsp;
          "10.251.116.152", &nbsp;
          "53", &nbsp;
          "0",&nbsp;
          "1",&nbsp;
          "enabled"&nbsp;
        ],&nbsp;
        [ &nbsp;
          "10.251.116.153", &nbsp;
          "53", &nbsp;
          "0",&nbsp;
          "1", &nbsp;
          "enabled" &nbsp;
        ]&nbsp;
      ]&nbsp;
    }&nbsp;
  },&nbsp;
  "generation": 0,&nbsp;
  "lastUpdateMicros": 0, &nbsp;
  "selfLink": ""&nbsp;
}  &nbsp;

sarah_258804 · Answer

Configuration of application profile below.

greg_labelle_31 · Answer

I notice that your virtual server is setup for UDP.  When the response for a DNS query contains more records than can fit in a single UDP packet, it will leverage TCP instead to send the query.  Try resolving a simple query that has only one record to test the theory. If this is the case, you'll need to setup a second virtual server at the same address and port using the TCP protocol as well to support both paradigms.

sarah_258804 · Answer

I tried that and no dice. I have a ticket open for this issue and it was pointed out that I didn't have a "DNS Profile" assigned to this virtual server. I added the basic DNS profile and still no resolving ip addresses with the virtual server IP.

Forum Discussion

Unable to access virtual server over port 53

Recent Discussions

Problem with lets encrypt and redirect after update

Should config via cli rather than gui?

Is a Dedicated Interface, VLAN, and Self IP Required for a VIP in an F5 Configuration?

question about getting hsl data to be formatted properly in splunk

iRule for client certificate verification and inserting CN

Related Content

Federated AWS Console Access Made Easy: F5 BIG-IP Access Policy Manager Access Guided Configurations

Verified Design: SSL Orchestrator with Palo Alto NGFW Virtual Edition-Part 1

Access internal DMZ virtual server in SSL VPN

Unable to login on web console

Unable to connect multiple networks

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS