Saucepan

User Tools

Site Tools

Trace: • dynamic_routing_example
infoblox_nios:forwarding

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
infoblox_nios:forwarding [2024/02/16 15:49] – bstaffordinfoblox_nios:forwarding [2025/07/01 18:47] (current) – bstafford
Line 29: Line 29:
 In short, No. The order in which the forwarders are listed has no bearing on the order in which they are used. In short, No. The order in which the forwarders are listed has no bearing on the order in which they are used.
  
 +===== DNSSEC =====
 +If DNSSEC validation is not enabled in NIOS, and if NIOS is configured to forward to another DNS server (e.g. NIOS caching/recursive layer) then NIOS sends DNS queries to the caching box with DNSSEC "CD" (Check Disabled) flag bit set to "1", and the caching server, irrespective of the local DNSSEC validation setting,  will not perform any validation locally and provides the response to the "forwarding DNS server", and the same response is sent back to the client. i.e. if you have full DNSSEC validation enabled on the external caching server but the Internal NIOS server does not have DNSSEC enabled then the external caching server will NOT perform DNSSEC validation for that query.
  
 +If you enable DNSSEC and have Trust Anchors configured on the internal DNS NIOS box, then the NIOS box will do the DNSSEC validation by forwarding the DNS and DNSKEY queries to the external caching layer to get the answers to.
 +
 +If you enabled DNSSEC and have NO Trust Anchors configured, then the internal DNS NIOS box will add CD (Check Disabled) flag bit set to "0" and it will mean that it is telling the external caching server to do the DNSSEC validation on its behalf.
 +
 +[[https://support.infoblox.com/s/article/302|Infoblox KB article]].
 +
 +===== DFP Forwarding =====
 +
 +[[https://docs.infoblox.com/space/nios90/1468465491/Specifying+Forwarders|Documentation]]
 +
 +When enabling the "Add" and "Copy" options under DNS Properties > Forwarding, we see the following notices/warnings
 +<code>The "Copy client IP, MAC addresses, and DNS View name to outgoing recursive queries" EDNS0 option will not function in the following scenarios even when you have enabled it: 
 +1. When you select the "Disable EDNS0" option. (Grid Properties > General > Advanced > "Disable EDNS0" (by default this option is disabled - thus EDNS0 is enabled by default)
 +2. When recursion is not enabled on the member.
 +3. The list of Grid or Member DNS forwarders is empty. When DFP is enabled on the node: DFP will re-write required statements to forwarder section of named-config. 
 +
 +Do you still want to proceed? Do you want to continue?</code>
 +
 +
 +<code>The "Add client IP, MAC addresses, and DNS View name to outgoing recursive queries" EDNS0 option will not function in the following scenarios even when you have enabled it: 
 +1. When you select the "Disable EDNS0" option.(Grid Properties > General > Advanced > "Disable EDNS0" (by default this option is disabled - thus EDNS0 is enabled by default)
 +2. When recursion is not enabled on the member.
 +3. The list of Grid or Member DNS forwarders is empty. When DFP is enabled on the node: DFP will re-write required statements to forwarder section of named-config. 
 +
 +Do you still want to proceed? Do you want to continue?</code>
 +
 +If DFP fails and Global Forwarders are NOT configured, root hints will be used and NIOS will not add source IP data to the queries.
 +
 +Notes on using "Add" and "Copy" options for NIOS Forwarding with DFP.
 +  * Source IP (Laptop) = 192.168.99.73 (Queries 192.168.11.211)
 +  * First NIOS Member = 192.168.11.211 (Forward only to 192.168.11.212)
 +  * Second NIOS Member = 192.168.11.212 (Forward only to 192.168.11.215)
 +  * Third NIOS Member  = 192.168.11.215 (DFP enabled and no forwarders configured locally)
 +
 +In the scenario below, the key is to ensure that the first layer has "Add" enabled and that the second and third layer have "Copy" enabled. If we assume that all clients query layer 1, we are good. We include "Add" in the second and third layers to allow for clients querying these layers directly.
 +
 +MAC Address will only get ADDED if the client IP is in the same subnet as the NIOS/NIOS-X appliance receiving it. Once added, it can be copied.
 +
 +^Source IP ^ 1 Add ^ 1 Copy ^ 2 Add ^ 2 Copy ^ 3 Add ^ 3 Copy ^ IP Recorded ^
 +| 192.168.99.73 | _ | _ | _ | _ | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | _ | _ | _ | _ | X | 192.168.11.212 |
 +| 192.168.99.73 | _ | _ | _ | _ | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | _ | _ | _ | X | X | 192.168.11.212 |
 +| 192.168.99.73 | _ | _ | _ | X | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | _ | _ | X | _ | X | 192.168.11.212 |
 +| 192.168.99.73 | _ | _ | _ | X | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | _ | _ | X | X | X | 192.168.11.212 |
 +| 192.168.99.73 | _ | _ | X | _ | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | _ | X | _ | _ | X | 192.168.11.211 |
 +| 192.168.99.73 | _ | _ | X | _ | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | _ | X | _ | X | X | 192.168.11.211 |
 +| 192.168.99.73 | _ | _ | X | X | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | _ | X | X | _ | X | 192.168.11.211 |
 +| 192.168.99.73 | _ | _ | X | X | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | _ | X | X | X | X | 192.168.11.211 |
 +| 192.168.99.73 | _ | X | _ | _ | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | X | _ | _ | _ | X | 192.168.11.212 |
 +| 192.168.99.73 | _ | X | _ | _ | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | X | _ | _ | X | X | 192.168.11.212 |
 +| 192.168.99.73 | _ | X | _ | X | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | X | _ | X | _ | X | 192.168.11.212 |
 +| 192.168.99.73 | _ | X | _ | X | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | X | _ | X | X | X | 192.168.11.212 |
 +| 192.168.99.73 | _ | X | X | _ | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | X | X | _ | _ | X | 192.168.11.211 |
 +| 192.168.99.73 | _ | X | X | _ | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | X | X | _ | X | X | 192.168.11.211 |
 +| 192.168.99.73 | _ | X | X | X | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | X | X | X | _ | X | 192.168.11.211 |
 +| 192.168.99.73 | _ | X | X | X | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | _ | X | X | X | X | X | 192.168.11.211 |
 +| 192.168.99.73 | X | _ | _ | _ | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | _ | _ | _ | _ | X | 192.168.11.212 |
 +| 192.168.99.73 | X | _ | _ | _ | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | _ | _ | _ | X | X | 192.168.11.212 |
 +| 192.168.99.73 | X | _ | _ | X | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | _ | _ | X | _ | X | 192.168.99.73 | 
 +| 192.168.99.73 | X | _ | _ | X | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | _ | _ | X | X | X | 192.168.99.73 | 
 +| 192.168.99.73 | X | _ | X | _ | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | _ | X | _ | _ | X | 192.168.11.211 |
 +| 192.168.99.73 | X | _ | X | _ | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | _ | X | _ | X | X | 192.168.11.211 |
 +| 192.168.99.73 | X | _ | X | X | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | _ | X | X | _ | X | 192.168.99.73 | 
 +| 192.168.99.73 | X | _ | X | X | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | _ | X | X | X | X | 192.168.99.73 | 
 +| 192.168.99.73 | X | X | _ | _ | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | X | _ | _ | _ | X | 192.168.11.212 |
 +| 192.168.99.73 | X | X | _ | _ | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | X | _ | _ | X | X | 192.168.11.212 |
 +| 192.168.99.73 | X | X | _ | X | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | X | _ | X | _ | X | 192.168.99.73 | 
 +| 192.168.99.73 | X | X | _ | X | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | X | _ | X | X | X | 192.168.99.73 | 
 +| 192.168.99.73 | X | X | X | _ | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | X | X | _ | _ | X | 192.168.11.211 |
 +| 192.168.99.73 | X | X | X | _ | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | X | X | _ | X | X | 192.168.11.211 |
 +| 192.168.99.73 | X | X | X | X | _ | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | X | X | X | _ | X | 192.168.99.73 | 
 +| 192.168.99.73 | X | X | X | X | X | _ | 192.168.11.212 |
 +| 192.168.99.73 | X | X | X | X | X | X | 192.168.99.73 | 
infoblox_nios/forwarding.1708098554.txt.gz · Last modified: by bstafford