Hey friends, I am setting up GSLB test environment with VPX 14.1 one onprem and one in Azure. On the Azure instance I cant seem to get ADNS to respond on Public IP. When I run nslookup against public IP I get query refused. It works fine via private IP. Does anyone know if there are any nuances around this? I tried a dedicated ADNS service IP as well as using the SNIP - same issue with both.

There’s a good write up here https://docs.netscaler.com/en-us/vpx/current-release/deploy-vpx-on-azure/citrix-adc-vpx-on-azure-gslb.html

thank you @Richard Faulkner unfortunately I don't see anything specific around public IP configs in there that is helpful with my issue. I am probably missing something.... For some reason when queried on public IP ADNS refuses to respond to query.

Is it cnamed to the azure DNS FQDN?

I havent forwarded domain yet. I am doing direct nslookup queries to the ADNS IP's. Want to make sure everything is working before I make domain changes

So, you have the names associated with the GSLB and you testing the ADNS response? If you look at the DNS section, does it show the FQDN you’ve assigned to GSLB and a dynamic IP

it does. and it responds normally on private IP... thats why I am wondering if somehow my NS is misconfigured or there is something else that needs to be done spefic to azure. I mean the Gateway VS responds to public IP just fine so its something ADNS.

Dumb question: is the port allowed and properly routed in Azure's firewall?

I was going to say check out your NSG on the external IP you are using. And make sure that the ADNS and GSLB services are bound to the Internet facing SNIP for proper routing, and to limit the firewall rules needed to just your 2 internet IPs.

Not using Azure firewall - only NSG. Doing additional checking....

I am not familiar enough with Azure, but I do know that what kind of IP address you choose does affect what traffic is permitted regardless of firewall or no firewall. You can do a test externally to see if port 53 is open for TCP or UDP to that appliance.

what kind of IP address as in from the Azure standpoint or the Netscaler?

Azure

I did more testing. Tried Azure load balancer -same issue. Assigned public IP directly to the interface again. Added TCP 53 service and did test-netconnection to the public IP and that responds. Its also logged in nstrace. NSlookup still fails. All of this works fine on another non-azure location where public IP is assigned directly to netscaler. Could it be some kind of DNS policy or setting that really does not like NAT for UDP 53?

I cannot think of anything. Without connecting up and viewing directly, I can't help any further. Maybe open a support ticket?

Yea will have to. Was trying to avoid it 😄

Understand. Sorry I couldn't help/

thank you @Richard Faulkner

That's interesting