- Introduction
- Integrated Solution
- Prerequisite Steps
- DNS LB for Geo-Proximity
- DNS LB for Active-Passive Sites
- DNS LB for Disaster Recovery
- DNS LB and Health Checks
- Conclusion
- Additional Resources
Introduction
To have both high performance and responsive apps available on the Internet, you need a cloud DNS that’s both scalable and one that operates at a global level to effectively connect users to the nearest point of presence. The F5 Distributed Cloud DNS Load Balancer positions the best features used with GSLB DNS to enable the delivery of hybrid and multi-cloud applications with compute positioned right at the edge, closest to users.
With Global Server Load Balancing (GSLB) features available in a cloud-based SaaS format, the Distributed Cloud DNS Load Balancer has a number distinct advantages:
- Speed and simplicity: Integrate with DevOps pipelines, with an automation focus and a rich and intuitive user interface
- Flexibility and scale: Global auto-scale keeps up with demand as the number of apps increases and traffic patterns change
- Security: Built-in DDoS protection, automatic failover, and DNSSEC features help ensure your apps are effectively protected.
- Disaster recovery: With automatic detection of site failures, apps dynamically fail over to individual recovery-designated locations without intervention.
Adding user-location proximity policies to DNS load balancing rules allows the steering of users to specific instances of an app. This not only improves the overall experience but it guarantees and safeguards data, effectively silo’ing user data keeping it region-specific. In the case of disaster recovery, catch-all rules can be created to send users to alternate destinations where restrictions to data don’t apply.
Integrated Solution
This solution uses a cloud-based Distributed Cloud DNS to load balance traffic to VIP’s that connect to region-specific pools of servers. When data privacy isn’t a requirement, catch-all rules can further distribute traffic should a preferred pool of origin servers become unhealthy or unreachable.
The following solution covers the following three DNS LB scenarios:
- Geo-IP Proximity
- Active/Standby failover within a region
- Disaster Recovery for manually activated failovers
The configuration for this solution assumes the following:
- The app is in multiple regions
- Users are from different regions
- Distributed Cloud hosts/manages/is delegated the DNS domain or subdomain
- (optional) Failover to another region is allowed
Prerequisite Steps
Distributed Cloud must be providing primary DNS for the domain. Your domain must be registered with a public domain name registrar with the nameservers ns1.f5clouddns.com and ns2.f5clouddns.com. F5 XC automatically validates the domain registration when configured to be the primary nameserver.
Navigate to DNS Management > domain > Manage Configuration > Edit Configuration >> DNS Zone Configuration: Primary DNZ Configuration > Edit Configuration. Select “Add Item”, with Record Set type “DNS Load Balancer”
Enter the Record Name and then select Add Item to create a new load balancer record.
This opens the submenu to create DNS Load Balancer rules.
DNS LB for Geo-Proximity
Name the rule “app-dns-rule” then go to Load Balancing Rules > Configure.
Select “Add Item” then under the Load Balancing Rule, within the default Geo Location Selection, expand the “Selector Expression” and select “geoip.ves.io/continent”.
Select Operator “In” and then the value “EU”. Click Apply. Under the Action “Use DNS Load Balancer pool”, click “Add Item”.
Name the pool “eu-pool”, and under Pool Type (A) > Pool Members, click “Add Item”.
Enter a “Public IP”, then click “Apply”. Repeat this process to have a second IP Endpoint in the pool.
Scroll down to Load Balancing Method and select “Static-Persist”.
Now click Continue, and then Apply to the Load Balancing Rule, and then “Add Item” to add a second rule.
In the new rule, choose Geo Location Selection value “Geo Location Set selector”, and use the default “system/global-users”.
Click “Add Item”.
Name this new pool “global-pool” and add then select “Add Item” with the following pool member: 54.208.44.177. Change the Load Balancing Mode to “Static-Persist”, then click Continue.
Click “Continue”. Now set the Load Balancing Rule Score to 90. This allows the first load balancing rule, specific to EU users, to be returned as the only answer for users of that region unless the regional servers are unhealthy. Note: The rule with the highest score is returned. When two or more rules match and have the same score, answers for each rule is returned. Although there are legitimate reasons for doing this, matching more than one rule with the same score may provide an unanticipated outcome.
Now click "Apply", “Apply”, and “Continue”. Click the final “Apply” to create the new DNS Zone Resource Record Set.
Now click “Apply” to the DNS Zone configuration to commit the new Resource Record.
Click “Save and Exit” to finalize everything and complete the DNS Zone configuration!
To view the status of the services that were just created, navigate to DNS Management > Overview > DNS Load Balancers > app-dns-rule.
Clicking on the rule “eu-pool”, you can find the status for each individual IP endpoint, showing the overall health of each pool’s service that has been configured.
With the DNS Load Balancing rule configured to connect two separate regions, when one of the primary sites goes down in the eu-pool users will instead be directed to the global-pool. This provides reliability in the context of site failover that spans regions. If data privacy is also a requirement, additional rules can be configured to support more sites in the same region.
DNS LB for Active-Passive Sites
In the previous scenario, two members are configured to be equally active for a single location. We can change the weight of the pool members so that of the two only one is used when the other is unhealthy or disabled. This creates a backup/passive scenario within a region.
Navigate to DNS Load Balancer Management > DNS Load Balancers. Go to the service name "app-dns-rule", then under Actions, select Manage Configuration. Click Edit Configuration for the DNS rule.
Go to the Load Balancing Rules section, and Edit Configuration.
On the Load Balancing Rules order menu, go to Actions > Edit for the eu-pool Rule Action.
In the Load Balancing Rule menu for eu-pool, under the section Action, click Edit Configuration.
In the rule for eu-pool, under Pool Type (A) > Pool Members click the Edit action
In the IP Endpoint section, change the Load Balancing Priority to 1, then click Apply.
Change the Load Balancing Mode to Priority, then exit and save all changes by clicking Continue, Apply, Apply, and then Save and Exit.
DNS LB for Disaster Recovery
Unlike with backup/standby where failover can happen automatically depending on the status of a service's health, disaster recovery (DR) can either happen automatically or be configured to require manual intervention. In the following two scenarios, I'll show how to configure manual DR failover within a region, and also how to manual failover outside the region.
To support east/west manual DR failover within the EU region, use the steps above to create a new Load Balancing Rule with the same label selector as the EU rule (eu-pool) above, then create a new DNS LB pool (name it something like eu-dr-pool) and add new designated DR IP pool endpoints.
Change the DR Load Balancing Rule Score to 80, and then click Apply.
On the Load Balanacing Rules page, change the order of the rules and confirm that the score is such that it aligns to the following image, then click Apply, and then Save and Exit.
In the previous active/standby scenario the Global rule functions as a backup for EU users when all sites in EU are down. To force a non-regional failover, you can change F5 XC DNS to send all EU users to the Global DNS rule by disabling each of the two EU DNS rule(s) above.
To disable the EU DNS rules, Navigate to DNS Load Balancer Management > DNS Load Balancers, and then under Actions, select Manage Configuration. Click Edit Configuration for the DNS rule.
Go to the Load Balancing Rules section, and Edit Configuration.
On the Load Balancing Rules order menu, go to Actions > Edit for the eu-pool Rule Action.
In the Load Balance Rule menu for eu-pool, under the section Action, click Edit Configuration.
In the top section labeled Metadata, check the box to Disable the rule. Then click Continue, Apply, Apply, and then Save and Exit.
With the EU DNS LB rules disabled, all requests in the EU region are served by the Global pool. When it's time to restore regional services, all that's needed is to re-enter the configuration rule and uncheck the Disable box to each rule.
DNS LB and Health Checks
For sake of simplicity the above scenarios do not have DNS LB health checks configured and it's assumed that each pool's IP members are always reachable and healthy. To support automatic failovers and to ensure that a user is always sent to a working server, F5 XC can perform health checks to all IP members in a DNS Load Balancer Pool.
To configure health checks for a pool, go to DNS Management > DNS Load Balancer Management > DNS Load Balancer Health Checks, then click "Add DNS Load Balancer Health Check". Name the rule, for example, "europe-healthcheck", and choose an appropriate health check type.
The following health check types are supported for DNS LB:
- HTTP
- HTTPS
- TCP
- TCP (Hex payload)
- UDP
- ICMP
Each health check type, except ICMP, supports sending a custom string payload, and looks for a response to match. For example, choosing the HTTPS health check, F5 XC will first confirm whether it receives a valid SSL certificate from the member. Passing the SSL certificate check, it then sends the configured "Send String" (an HTTP request). By default, the string is "HEAD / HTTP/1.0\r\n\r\n", although more complex strings are supported. The "Receive String", in regex (re2) format, validates the application layer response. The default receive string for an HTTP(S) requests is "HTTP/1." A custom TCP or UDP port can also be configured to support services running on non-standard ports. Configuring the port with "0" uses the default port belonging to the intended protocol.
To apply the health check to a DNS LB Load Balancing rule, navigate to DNS Load Balancer Management > DNS Load Balancer Pools. Locate the pool to apply the health check to, and use the Manage Configuration action. Within the pool configuration, click Edit Configuration, scroll down to DNS Load Balancer Health Check, enable it, and then choose the health check created above. Save and Exit the Pool.
Status information about the health of the DNS LB pools and pool members can be found at the DNS Load Balancers Overview page. In the following example, one of the members in the "eu-pool" is unhealthy. Details about each specific pool member can be found by clicking on the pool.
Conclusion
Using the Distributed Cloud DNS Load Balancer enables better performance of your apps while also providing greater uptime. With scaling and security automatically built into the service, responding to large volumes of queries without manual intervention is seamless. Layers of security deliver protection and automatic failover. Built-in DDoS protection, DNSSEC, and more make the Distributed Cloud DNS Load Balancer an ideal do-it-all GSLB distributor for multi-cloud and hybrid apps.
To see a walkthrough where I configure first scenario above for Geo-IP proximity, watch the following accompanying video.
Additional Resources
More information about Distributed Cloud DNS Load Balancer available at:
https://www.f5.com/cloud/products/dns-load-balancer
Product Documentation:
DNS LB Product Documentation
DNS Zone Management
