Creating a Topology-based DTC Policy in Universal DDI (2609)

Scenario

Your organization wants some authoritative domain names to return different answers based on which subnet the DNS query originates. This calls for a DNS Traffic Control (DTC) topology-based policy. In this lab, you will create a source-based policy for the domain name webapp.dtc.techblue.net. When queried from the management networks (10.100.0./24 and 10.200.0./24), clients should receive the normal answers from Pool A. When queried from the production networks (172.31.0.0/16), clients should receive NXDOMAIN.

Estimated Completion Time

• 30 minutes

Prerequisites

• Administrative access to the Infoblox Portal

• Lab 2801: Deploying NIOS-X Servers

• Lab 2573: Configuring DNS Services in Universal DDI

• Lab 2574: Creating a DNS Primary Zone in Universal DDI

• Lab 2606: Creating a Primary Subzone for DTC in Universal DDI

• Lab 2607: Creating Core DTC Objects in Universal DDI

Learning Content

• Creating DNS Config Profiles

• Creating DNS Primary Zones

• Configuring Core DTC Objects in the Infoblox Portal

• Configuring DTC Policies in the Infoblox Portal

Tasks

1. Create the source-based policy.

2. Create the LBDN for the source-based policy.

3. Test topology behavior from the client side.

Task 1: Create the source-based policy

Create a policy named Techblue Topology Policy and define the subnet-to-pool mappings used for the activity.

Task 2: Create the LBDN for the source-based policy

Create the LBDN webapp.dtc.techblue.net and associate it with the Techblue Topology Policy

Task 3: Test topology behavior from the client side

Use oph3, testing-linux, and jump-desktop to test webapp.dtc.techblue.net and confirm that each client receives the expected result.

Solutions

Task 1 Solution: Create the source-based policy

This step introduces topology-based decision logic into the DTC configuration. Instead of treating all clients the same, the policy uses source networks to steer queries to different pools.

1. Log in to your lab’s jump-desktop.

2. Use the Education Infoblox Portal credentials to sign in to the Infoblox Portal.

3. Navigate to Network → DNS.

4. Expand the DTC tab and select DTC Policies.

5. Click Create DTC Policy.
   

   

6. Create the first Policy using these values:
   Leave the State as Enabled.
   Enter the Name as Techblue Topology Policy.
   Provide Description as Source-based Policy for webapp.

   Choose the Load Balancing Type as Topology.
   

   

7. Click Next.

8. Click Add Pool and choose Pool A, then click Next.
   

   

9. Click Add Rule dropdown and choose Subnet Rule
   

   

10. For Name add MGMT Network Rule

11. For Destination choose Pool and select Pool A from Select List, then click Next.
    

    

12. Click Add twice and add subnets 10.100.0.0/24 and 10.200.0.0/24 then click Next and Save.
    

    

13. Click Add Rule dropdown again and choose Subnet Rule
    

    

14. For Name add Production Rule

15. For Destination choose Return NXDOMAIN and click Next.

    

    
    

16. Click Add and add the subnet 172.31.0.0/16 then click Next and Save
    

    

17. Click Finish and Save and Close.

    
    

    
    

Task 2 Solution: Create the LBDN for the source-based policy

This step exposes the source-aware policy through a client-facing DNS name. The LBDN becomes the entry point that allows DTC to apply the topology rules whenever a client sends a query.

1. Log in to your lab’s jump-desktop.

2. Use the Education Infoblox Portal credentials to sign in to the Infoblox Portal.

3. Navigate to Network → DNS.

4. Expand the DTC tab and select LBDNs.

5. Click Create LBDN.
   

   

6. Create the LBDN using these values:
   For DNS View choose default.
   Enter the Name as webapp.dtc.techblue.net.
   Leave the Precedence field blank.
   For Load Balancing Policy choose Techblue Topology Policy.
   For Description add Monitoring service for MGMT only.
   

   

7. Click Save and Close.

Task 3 Solution: Test Topology behavior from the client side

This step confirms that the policy behaves differently depending on the client source. The expected result is not a simple round-robin distribution, but source-specific resolution behavior.

1. Log in to virtual machine testing-linux and open a terminal window

2. Run dig @10.100.0.110 webapp.dtc.techblue.net. A +short

3. Repeat the query a few times and note the responses

4. Confirm that testing-linux returns NXDOMAIN
   

   

5. Switch to virtual machine jump-desktop and open a terminal window

6. Run dig @10.100.0.110 webapp.dtc.techblue.net. A +short

7. Repeat the query a few times and note the responses

8. Confirm that jump-desktop returns NOERROR with no answer data
   

   

9. Switch to virtual machine oph3:
   username: training
   password: infoblox

10. Run dig @10.100.0.110 webapp.dtc.techblue.net. A +short

11. Repeat the query a few times and note the responses

12. Confirm that oph3 receives Pool A IP addresses