This slides will help you to understand the different flavor of DNS Services offered by various vendors like F5, AWS and Cisco.

1. By Dhruv Sharma

2. • Dhruv Sharma
• Experienced IT Professional – CISSP, OSCP, CCNP-Sec, AWS Architect
• Linked In: https://www.linkedin.com/in/dhruv-sharma-/

3. Introduction
• Does your business have a disaster recovery plan for natural disaster ?
• Does your business have global clients that need regional access to content ?
• Does your business want to maximize your investment in secondary datacenter ?
• Is DNS management error prone and cumbersome ?
• Do you follow a multi-step manual failover process ?

4. Introduction
• F5 GTM (BIG-IP DNS): F5® BIG-IP® Global Traffic Manager™ (GTM)
distributes DNS and user application requests based on business policies,
data center and cloud service conditions, user location, and application
performance.
https://www.f5.com/pdf/products/big-ip-global-traffic-manager-ds.pdf
• AWS Route 53: Amazon Route 53 is a highly available and scalable cloud
Domain Name System (DNS) web service. Amazon Route 53 is fully
compliant with IPv6 as well. Amazon Route 53 effectively connects user
requests to infrastructure running in AWS – such as Amazon EC2 instances,
Elastic Load Balancing load balancers, or Amazon S3 buckets – and can also
be used to route users to infrastructure outside of AWS.
https://aws.amazon.com/route53/

5. • GTM Building Blocks

6. Load Balancing Mechanism
• GTM Load Balancing Mechanism:

7. Load Balancing Mechanism
• We define load balancing mechanism in two sections:
• Create Pool
• Create wide IP

8. Load Balancing Mechanism
• Topology: BIG-IP GTM distributes DNS name resolution requests using proximity-based load
balancing. BIG-IP GTM determines the proximity of the resource by comparing location
information derived from the DNS message to the topology records in a topology statement you
have configured.
• The Global Availability load balancing method instructs BIG-IP GTM to select the first pool in the
wide IP pool list until it becomes unavailable, and then to select the next pool in the list until the
first pool becomes available again. This ensures that the most robust pool receives DNS name
resolution requests, while the other pools act as backups in case the primary pool becomes
unavailable.

9. Configuration Summary
• Step 1: Define the GTM Datacenter
• Step 2: Add the Servers
• Step3: Create Pool Members
• Step 4: Create Wide IP
• Step 5: Define GTM Listener

10. Topology

11. Step 1: Define the GTM Datacenter
• Create two datacenters as shown below – India and UK

12. Step 2: Add the Servers
• Define the Servers in the server list, which include the servers and the
GTM themselves.

13. Step3: Create Pool Members
• Create pool with India and UK server members.
• Select the Load balancing mechanism

14. Step 4: Create Wide IP
• Create a new Wide IP – www.cow.com & select the load balancing mechanism

15. Step 5: Define GTM Listener
• Define the listener address.

16. Testing
• We can confirm first the URI
resolves into India URI and later
to UK URI.

17. Costing
• If we want to start a GTM service for your company, with bare minimum costing is
described:
• Device Cost: $ 3977 (https://www.amazon.com/F5-Networks-F5-BIG-LTM-1600-R-
Enterprise/dp/B00EAR456Y )
• License Cost: $9,795.10 (tentative costing – not sure)

18. Extra Features
• Zone-Runner: Easy Authoritative DNS Management (NS, SOA, A
Records)
• DNS Sec (https://www.youtube.com/watch?v=MrtsKTC3KDM )
• iRules – Flexibility to define distribution policies
• IPv6 AAAA records support.
• Application Specific monitor
• Supports iControl.
• CDN Support.

19. • Building Blocks AWS Route 53

20. AWS Route 53
• A hosted zone is a collection of resource record sets hosted by Amazon Route 53. Like a
traditional DNS zone file, a hosted zone represents resource record sets that are managed
together under a single domain name. Each hosted zone has its own metadata and configuration
information.
• Supported record types include:
• A
• AAAA
• CNAME
• MX
• NS
• PTR
• SOA
• SPF
• SRV
• ALIAS

21. Load Balancing Mechanism
• When you create a resource record set, you choose a routing policy, which determines how
Amazon Route 53 responds to queries.
• Routing policies can be associated with health checks, so resource health status is considered
before it even becomes a candidate in a conditional decision tree. A description of possible
routing policies and more on health checking is covered in this section.

22. Load Balancing Mechanism
1. Simple: This is the default routing policy when you create a new resource. Use a simple routing
policy when you have a single resource that performs a given function for your domain (for
example, one web server that serves content for the example.com website). In this case, Amazon
Route 53 responds to DNS queries based only on the values in the resource record set (for example,
the IP address in an A record).

23. Load Balancing Mechanism
2. Weighted: With weighted DNS, you can associate multiple resources (such as Amazon Elastic
Compute Cloud [Amazon EC2] instances or Elastic Load Balancing load balancers) with a single DNS
name.

24. Load Balancing Mechanism
3. Latency-based routing: allows you to route your traffic based on the lowest network latency for
your end user (for example, using the AWS region that will give them the fastest response time).
• Use the latency routing policy when you have resources that perform the same function in
multiple AWS Availability Zones or regions and you want Amazon Route 53 to respond to DNS
queries using the resources that provide the best latency.

25. Load Balancing Mechanism
4. Use a failover routing policy: to configure active-passive failover, in which one resource takes all
the traffic when it’s available and the other resource takes all the traffic when the first resource isn’t
available. Note that you can’t create failover resource record sets for private hosted zones.

26. Load Balancing Mechanism
5. Geo-location Routing: Let you choose where your traffic will be sent based on the geographic
location of your users (i.e. the location from which DNS queries originated). For example, you might
want all queries from Europe to be routed to a fleet of EC2 instance configured specifically for
Europe customers.

27. AWS Route 53 Implementation
• Building Blocks:
• Step 1: Register a domain on AWS or external domain providers like godaddy.
• Step 2: Setup the servers (EC2 for instance)
• Step 3: Create Health Policy
• Step 4: Creating DNS-Routing policy

28. Topology

29. Step 1: Register a domain
• Register for a new domain or setup for an existing domain as shown below. You can buy a new
domain directly from AWS or via external vendor like godady and use it here -
https://www.radishlogic.com/aws/using-godaddy-domain-in-aws-route-53/

30. Step 2: Setup the servers
• We have successfully hosted two server = 3.8.118.98 & 13.232.6.171

31. Step 3: Create Health Policy
• Optionally configure the health policy, we will use them while we create the DNS policy.

32. Step 4: Creating DNS-Routing policy
• Finally configure the DNS policy as shown below.

33. Costing
• Reference : https://aws.amazon.com/route53/pricing/

34. Costing
• You pay only for what you use. There are no minimum fees, no minimum usage
commitments, and no overage charges.
• Refer to AWS price calculator: https://calculator.aws/#/

35. Extra Features
• DNSSec is supported.

36. References
• https://www.youtube.com/watch?v=509OS3x-k1A
• https://devcentral.f5.com/s/articles/using-big-ip-gtm-to-integrate-
with-amazon-web-services

37. Quick Tips
• If you are new to AWS, you can create your account for AWS from link -
https://aws.amazon.com/

38. • Security

40. Introduction
• According to Cisco’s research, over 90% of attacks are done over DNS and only two-thirds of
organizations monitor their DNS records. Fortunately, Cisco Umbrella has a feature that would
prevent a user from accessing a site, directly using it’s IP address, if it’s known to be malicious.
• If you are using your default DNS service, through your internet service provider, you are allowing
your desktop or servers to connect to any website without a security filter.
• Umbrella keeps a record of all websites that have been known to be malicious and prevents users
from accessing the site. Many sites that were once safe, could have been hijacked recently and
can host viruses and trojans that can then be pushed down to unsuspecting users.

41. Introduction
• Prevents phishing attacks - Cisco Umbrella would prevent you from accessing phishing site if it has
been around long enough for Cisco to detect it.
• Prevents Ransomware attacks - Ransomware relies heavily on connecting back to their Command
and Control Centre to receive its encryption password to encrypt your files.
Umbrella detects these DNS queries in real time and uses anomaly detection algorithms, new
domain clustering, and domain reputation system. Even if you were to install the virus,
CiscoUmbrella will prevent your system from talking back to the Command and Control Center
and thus preventing encryption.
• Content Filtering – It has an ability to use content filtering to prevent its users from accessing sites
that are not allowed.

42. Implementations
• Home users can protect themselves for free by simply putting in 208.67.222.222 and
208.67.220.220 in their DNS, thus opting for Open DNS.
• Visit URI - https://welcome.opendns.com/

43. Implementations
• For enterprise environments, there are several options to implement Umbrella services through
the network. At a minimum, you could set your DNS on workstations and servers manually to
Umbrella’s DNS IP’s. However, if you add Umbrellas Virtual Appliances and use their AD connector
to integrate with your internal DNS server, you will gain further insight into the network.
• For Remote VPN Users - Windows and Mac laptop users can also be protected if Roaming Client
agent is installed. When the laptop is on the network, it will be disabled since it recognized the
DNS of the Virtual Appliances. When the user is at home and off the network, it will re-enable
itself and the user will be protected by Umbrella.

44. Cost
• Cisco Umbrella offers below packages for installation:
• Wireless LAN – Based on number of Access Points
• Professional – Based on number of Users
• Insights – Based on number of Users
• Platform – Based on number of Users
For more details refer below link:
• Ref: https://umbrella.cisco.com/opendns-cisco-umbrella
• Ref: https://learn-umbrella.cisco.com/datasheets/cisco-umbrella-package-comparison-2

45. References
• https://umbrella.cisco.com/opendns-cisco-umbrella

46. Cisco FTD – DNS Policies
• Firepower system provides the ability to intercept DNS traffic requests and looks for the malicious
domain name. If Firepower module finds a malicious domain, the Firepower takes appropriate
action to mitigate the request as per configuration of DNS policy.
• New attack methods designed to breach IP-based intelligence, misuse DNS load balance features
in order to hide the actual IP address of a malicious server. While the IP addresses associated with
the attack are frequently swapped in and out, the domain name is rarely changed.
• Firepower provides the ability to redirect the malicious request to a sinkhole server which can be
a honeypot server to detect, deflect or study attempts to know more about the attack traffic.

47. New DNS working with FTD
• Option 1: We can traditionally create an access control policy to block
DNS traffic as shown below.
5/25/2020 47

48. New DNS working with FTD
• Option 2: DNS-based Security Intelligence
Firepower allows you to identify a susceptible DNS query and blacklist the resolution of an unsafe
domain name, while any queries to legitimate websites are allowed. It leads to a browser not being
able to obtain the IP address of a website. FTD blocks the request for a website before a potential
HTTP connection is even established. Consequently, FTD does not need to engage its resources for
further HTTP inspection.
5/25/2020 48

49. New DNS working with FTD
• DNS Actions – Domain not Found, Drop, Sink Hole
5/25/2020 49

50. Questions ??