ADC

DNS Support for the Responder Feature

September 14, 2021

Contributed by:

S S

You can configure the responder feature to respond to DNS requests as it does to HTTP and TCP requests. For example, you could configure it to send DNS responses over UDP and ensure that the DNS requests from the client are sent over TCP. A number of Citrix ADC expressions support examination of the DNS header in the request. These expressions examine specific header fields and send an appropriate response.

DNS Expressions. In a responder configuration, you can use the following Citrix ADC expressions to refer to various portions of a DNS request:

Expressions	Descriptions
DNS.NEW_RESPONSE	Creates a new empty DNS response based on the request.
DNS.NEW_RESPONSE `<AA, TC, rcode>`	Creates a new DNS response based on the specified parameters.

DNS Bind Points. The following global bind points are available for policies that contain DNS expressions.

Bind Points	Descriptions
DNS_REQ_OVERRIDE	Priority/override request policy queue.
DNS_REQ_DEFAULT	Standard request policy queue.

In addition to the default bind points, you can create policy labels of type DNS and bind DNS policies to them.

Configuring Responder Policies for DNS

The following procedure uses the Citrix ADC command line to configure a responder action and policy and bind the policy to a responder-specific global bind point.

To configure Responder to respond to a DNS request:

At the command prompt, type the following commands:

add responder action <actName> <actType>

For <actname>, substitute a name for your new action. The name can be 1 to 127 characters in length, and can contain letters, numbers, hyphen (-), and underscore (_) symbols. For <actType>, substitute a responder action type, respondWith.
add responder policy <polName> <rule> <actName>

For <polname>, substitute a name for your new policy. For <actname>, the name can be 1 to 127 characters in length, and can contain letters, numbers, hyphen (-), and underscore (_) symbols. For <actname>, substitute the name of the action that you just created.
bind responder policy <polName> <priority> <nextExpr> -type <bindPoint>

For <bindPoint>, specify one of the responder-specific global bind points. For <polName>, substitute the name of the policy that you just created. For <priority>, specify the priority of the policy.

Sample configuration - Enforce all DNS request over TCP:

To enforce all the DNS requests over TCP, create a responder action that will set the TC bit and rcode as NOERROR.

> add responder action resp_act_set_tc_bit respondwith DNS.NEW_RESPONSE(true, true, NOERROR)
Done

> add responder policy enforce_tcp  dns.REQ.TRANSPORT.EQ(udp)  resp_act_set_tc_bit
Done

>bind lb vserver dns_udp –policyName  enforce_tcp   -type request –priority 100
Done
<!--NeedCopy-->

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

DNS Support for the Responder Feature

September 14, 2021

Contributed by:

S S

September 14, 2021

Contributed by:

S S

DNS Support for the Responder Feature

Configuring Responder Policies for DNS

In this article