Source
r/f5networks•
DeathGhost

DNS server health monitor

I'm load balancing some DNS servers via LTM and the profile someone set in the past was a default udp monitor which does... Well really nothing. I'm looking to see if there is something better. I've struggled to find anything online and wanted to see how anyone else might do it. I'm wondering if I'll need to create a custom external monitor. Any suggestions welcome! Plan to use a layer 4 performance type for a new VIP I got to build for more DNS servers too. Any suggestions on anything different is very welcome!

Posted Feb 11, 2022, 5:49 AM UTC

57
wpskierLTM•

Why not use a DNS monitor? I use several in my environment and they work just fine.

What version of BIG-IP are you using? I know that older versions don't have a built-in DNS monitor, and in those situations, I've used an external monitor that executed 'dig'. Like smeenz says, you just need to be careful that you only output to stdout if the dig is successful.

Let me know if you want an example external monitor that executes 'dig'.

3
DeathGhostOP•

I'm on latest version of 14. I looked earlier and had no built in DNS monitor profiles, and struggled to find something online.

A external doing dig was what I was thinking I would need to do, but wasn't sure. I might end up going that route or a custom udp monitor with a query string in it.

1
smeenzLTM•

Because UDP is connectionless, there's no way to know whether the packet actually reached the target, unless that target, or some other device in the path, responds.

On the default UDP monitor, no recv (receive) string is defined, so the only way that bigip can know that the device is down is if it gets an ICMP message back, such a host unreachable, or if directly connected, an ARP failure. This is what throws most people, because the UDP monitor configured this way will not mark a host down that is turned off or disconnected from the network, unless it gets that ICMP message back.

But you can define a send and recv string, and the monitor will be mark the target down if it doesn't see that string. You can use \0xx to specify a binary string, and send a valid DNS request, and expect a specific DNS response in reply. But this can be restrictive and error prone. An external monitor that runs a bash script that runs a dig command would be more reliable, and easier to troubleshoot.

Note that for external monitors, any output to stdout is considered a successful result, so you must be careful not to run any commands that aren't redirected into a variable or to /dev/null, as their output would always mark the monitor up.

You also need to think about what it is that you want to monitor - for example, if you only care whether the box is running (and aren't concerned about a DNS-specific test), then a gateway_icmp monitor might be appropriate.

2
DeathGhostOP•

Really appreciate the reply!

Def didn't see the point of the default udp monitor we had, as if was pointless!

I think external monitor might be the route that I end up going. I might try the method you mentioned with the udp monitor but I like the flexibility the ext mon would provide

1
smeenzLTM•

Or, as others have mentioned, if you're not intending to do anything complicated with an external dig, you could use the built-in DNS monitor type (there aren't any pre-defined dns monitors, you'll need to first create one - that might be why you didn't see it in the list)

tmsh create ltm monitor dns mydnsmonitor qname www.example.org qtype a

Or in the GUI,

Local Traffic >> Monitors >> Create 

Name: mydnsmonitor
Type : DNS
(fill in the details)
2
DeathGhostOP•

Would you look at that! Thanks a bunch for this! I was able to see it now.

2
DeathGhostOP•

Thanks, will give that a shot today!!

1