For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

sathish_126179's avatar
sathish_126179
Icon for Nimbostratus rankNimbostratus
Mar 31, 2014

ZoneRunner Replication

We have implemented master DNS using F5 GTM zonerunner. There are 3 slave DNS servers out of which 2 are running in Linux Bind and one acting as F5 GTM slave. Any DNS records entered in F5 GTM master takes around 1 hour to get replicated to slave servers. I understand these records depends on zone runner & named service. Is it possible to minimize the replication interval (say around 15-20 mins) without restarting these services manually? Previously, we had master DNS in Linux BIND and whenever named was restarted the records used to get updated instantly in the slave servers.

 

design

3 Replies

  • IheartF5_45022's avatar
    IheartF5_45022
    Icon for Nacreous rankNacreous
    Mar 31, 2014

    Have you set up notifications on the master zone? That way the master will notify the slave when it has an update rather than polling at intervals;-

    zone "example.com" {
  type master;
  file "/var/lib/bind/db.example.com";
  notify yes;
  // ...
};

    Otherwise the poling interval is setup in the SOA, but notification is way better....

  • sathish_126179's avatar
    sathish_126179
    Icon for Nimbostratus rankNimbostratus
    Mar 31, 2014

    Thanks IheartF5 for your reply :) Yes, we have notification ("notify yes" statement) setup in the named.conf file for each zone. The DNS records updated in GUI doesn't reflect in zone file quickly and takes around 30 mins to get updated. Is there anyway to reduce this time interval?

     

  • IheartF5_45022's avatar
    IheartF5_45022
    Icon for Nacreous rankNacreous
    Apr 01, 2014

    Are there firewalls between the master and slave servers?

    It sounds as though notifications from master to slaves are not working and so it's falling back to slaves polling the master. This could be down to a firewall not allowing the notifications through but allowing the polling?

    You need to debug why notifications are not working (if not firewall reason). Start by running tcpdump on the master GTM as you make zone file updates;-

    tcpdump -i0.0 -s0 -XX dst-ip \ or dst-ip \