DNS Security (DNSSEC) With BIG-IP Global Traffic Manager

DNS Security (DNSSEC)With BIG-IP Global Traffic Manager

DNS Infrastructure is VulnerableSpoofing and cache poisoning allow hijacking of domains
Example.com
www.example.com?
www.example.com?
GSLB
123.123.123.123
012.012.012.012
App Servers
LDNS
012.012.012.012
Cache poisoning
Spoofing with first response
Problem
Need to secure DNS infrastructure
Cache poisoning and spoofing can hijack DNS records
Need a method for trusted responses
Need to meet US Government mandate for DNSSEC compliance
Hacker

What is DNSSEC?
DNS protocol extensions ensure the integrity of data returned by domain name lookups.
Incorporates a “chain of trust” into the DNS hierarchy using public key cryptography (PKI).
Each link in the chain consists of a public-private key pair.
Provides origin authenticity, data integrity, and secure denial of existence.
Origin authenticity: Resolvers can verify that data has originated from authoritative sources.
Data integrity: Can also verify that responses are not modified in-flight.
Secure denial of existence: When there is no data for a query, authoritative servers can provide a response that proves no data exists.

How Does DNSSEC Work?
Each DNSSEC zone creates one or more pairs of public/private key(s)
Public portion put in DNSSEC record type DNSKEY
Zones sign all sets with private key(s) and resolvers use DNSKEY(s) to verify sets
Each set has a signature attached to it: RRSIG
So, if a resolver has a zone’s DNSKEY(s) it can verify that sets are intact by verifying their RRSIGs

Securing the DNS InfrastructureDynamic and secure DNS with Global Traffic Manager
Example.com
www.example.com?
www.example.com?
BIG-IP GTM
123.123.123.123
+ public key
123.123.123.123
+ public key
App Servers
LDNS
Client gets signed, trusted response
BIG-IP Global Traffic Manager with DNSSEC
Solution
Secure and dynamic DNS
Ensure users get trusted DNS queries with signed responses
Reduce management costs – Simple to implement and maintain
Meet mandates with DNSSEC compliant solution
Hacker

Drop-in DNSSEC Compliance
Example.com
site.example.com?
BIG-IP GTM
Existing
DNS Servers
172.16.124.1
+trusted SSL key
BIG-IP Global Traffic Manager with DNSSEC
Simple DNSSEC compliance
Drop GTM in front of existing DNS servers
GTM signs requests without changes to DNS configuration

Find Out More on DNSSEC
Video: DNSSEC in Five Easy Steps
Blog: It’s DNSSEC not DNSSUX
Tech Tip: Configuring GTM’s DNS Security Extensions

DNS Security (DNSSEC) With BIG-IP Global Traffic Manager

by DSorensenCPR on Dec 03, 2009

Accessibility

Categories

Tags

Upload Details

Usage Rights

1 Embed 17

Statistics

DNS Security (DNSSEC) With BIG-IP Global Traffic Manager — Presentation Transcript