The F5 BIG-IP DNS implementation must protect the authenticity of communications sessions for zone transfers.

DNS is a fundamental network service that is prone to various attacks, such as cache poisoning and man-in-the middle attacks.

If communication sessions are not provided appropriate validity protections, such as the employment of DNSSEC, the authenticity of the data cannot be guaranteed.

If the BIG-IP is transferring zones from another non-BIG-IP DNS server perform the following.

From the BIG-IP GUI: 1. DNS. 2. Zones. 3. Click on the Zone Name. 4. Under the TSIG section verify a "Server Key" is selected.

From the BIG-IP Console, type the following commands:

tmsh list ltm dns zone <name> server-tsig-key

Note: Must return a value other than "none".

If the BIG-IP appliance is not configured to protect the authenticity of communications sessions for zone transfers, this is a finding.

From the BIG-IP GUI: 1. DNS. 2. Zones. 3. Click on the Zone Name. 4. Under the TSIG section, select a "Server Key" from the drop-down menu. 5. Click "Update".

From the BIG-IP Console, type the following commands: tmsh modify ltm dns zone <zone name> server-tsig-key <TSIG key name> tmsh save sys config