F5 DNS listener protection from DDOS and other attacks

[Harutyun]

We have F5 Big-IP VE with license GTM(DNS). I have configured gslb.example.com zone in ZoneRunner and delegate it in our external (ISP) DNS servers in order to our clients get information for zone gslb.example.com from our F5 big-IP VE. Notify, that there is a PaloAlto 3020 in front of F5 Big-IP VE.

How can I protect my DNS Listeners from DDOS and other attacks?

[Samir]

Modern security device has the capabilities to protect ​network from attack such as DOS, DDOS, Syn flood etc. As you said palo alto is front then F5 DNS. So these devices has DDOS protection machanism. If possible add one more layer between palo alto n F5 DNS.

Thanks​

[Harutyun]

Hi  . Thank you for your respond. What do you mean one more layer between PA and F5 DNS? Is there necessary to implement F5 AWAF with DNS?

[Samir]

AWAF will not help here.you can add additional L3 layer(i.e firewall,etc)

[Harutyun]

We also have Cisco router(Nat, VPN, Acces Lists) in front of PA.