For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

cccu_werner's avatar
cccu_werner
Icon for Altostratus rankAltostratus
Apr 22, 2021

Using RESOLVER::name_lookup to return an IP address for a FQDN

Hi.   We are running 15.1 and we have a Virtual Server (webservice app) with an irule that only allows certain IP addresses making requests to it.   One of our external service providers hav...
application delivery
BIG-IP
iRules
cccu_werner's avatar
cccu_werner
Icon for Altostratus rankAltostratus
Apr 23, 2021

Hi Jason

 

Here is a section of the irule

 

when HTTP_REQUEST { 

 

#work in progress section

  set fqdn testing.test-url.com

  set ips [RESOLVER::name_lookup "/Common/f5-aws-dns" $fqdn a]

   

  log local0. "$fqdn IP address resolved to $ips"

   

  set rs [RESOLVER::summarize $ips]

  log local0. "which resolves to $rs"

 

}

 

Yes we have read through your article.

 

Many thanks

  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Apr 27, 2021

    Hi there. Sorry for the delay. Since you are using the /Common/f5-aws-dns resolver, did you modify it to include the zone for which your fqdn resides? For example, if I'm going to look up espn.com on my local test box, my aws resolver would need to look like this:

    net dns-resolver f5-aws-dns {
    forward-zones {
        amazonaws.com {
            nameservers {
                8.8.8.8:domain { }
            }
        }
        espn.com {
            nameservers {
                8.8.8.8:domain { }
            }
        }
        idservice.net {
            nameservers {
                8.8.8.8:domain { }
            }
        }
        shpapi.com {
            nameservers {
                8.8.8.8:domain { }
            }
        }
    }
    route-domain 0
}

    And if I change my iRule to do more logging like this:

    when CLIENT_ACCEPTED {
  set fqdn espn.com
  set lookup_result [RESOLVER::name_lookup "/Common/f5-aws-dns" $fqdn a]
  log local0.debug "Lookup: $lookup_result"
  set lookup_summary [RESOLVER::summarize $lookup_result]
  log local0.debug "Summary: $lookup_summary"
  foreach rr $lookup_summary {
    log local0.debug $rr
    log local0.debug [lindex $rr 4]
  }
}

    Then my results are:

    Apr 27 17:38:39 ltm15a debug tmm1[87967]: Rule /Common/resolver_test <CLIENT_ACCEPTED>: Lookup: 000081800001000400000000046573706E03636F6D0000010001C00C000100010000003B00046354A008C00C000100010000003B00046354A00AC00C000100010000003B00046354A037C00C000100010000003B00046354A044
Apr 27 17:38:39 ltm15a debug tmm1[87967]: Rule /Common/resolver_test <CLIENT_ACCEPTED>: Summary: {espn.com.	59	IN	A	99.84.160.8} {espn.com.	59	IN	A	99.84.160.10} {espn.com.	59	IN	A	99.84.160.55} {espn.com.	59	IN	A	99.84.160.68}
Apr 27 17:38:39 ltm15a debug tmm1[87967]: Rule /Common/resolver_test <CLIENT_ACCEPTED>: espn.com.	59	IN	A	99.84.160.8V
Apr 27 17:38:39 ltm15a debug tmm1[87967]: Rule /Common/resolver_test <CLIENT_ACCEPTED>: 99.84.160.8
Apr 27 17:38:39 ltm15a debug tmm1[87967]: Rule /Common/resolver_test <CLIENT_ACCEPTED>: espn.com.	59	IN	A	99.84.160.10
Apr 27 17:38:39 ltm15a debug tmm1[87967]: Rule /Common/resolver_test <CLIENT_ACCEPTED>: 99.84.160.10
Apr 27 17:38:39 ltm15a debug tmm1[87967]: Rule /Common/resolver_test <CLIENT_ACCEPTED>: espn.com.	59	IN	A	99.84.160.55
Apr 27 17:38:39 ltm15a debug tmm1[87967]: Rule /Common/resolver_test <CLIENT_ACCEPTED>: 99.84.160.55
Apr 27 17:38:39 ltm15a debug tmm1[87967]: Rule /Common/resolver_test <CLIENT_ACCEPTED>: espn.com.	59	IN	A	99.84.160.68
Apr 27 17:38:39 ltm15a debug tmm1[87967]: Rule /Common/resolver_test <CLIENT_ACCEPTED>: 99.84.160.68

    I added espn.com to the aws resolver since you're using it, but in a real scenario, I'd create a standalone resolver specifically for the iRule instead of modifying the aws one.