To fix domain session cookie resolution issues during AAA authentication, which DNS configuration is recommended?

• A. Configure DNS to assign authentication and traffic management virtual servers to FQDNs in the domain.
• B. Configure FQDNs for the Session Cookies in the domain.
• C. Change the Session Cookie timeout in DNS.
• D. Configure DNS to assign an FQDN for the NetScaler in the domain.

Answer: (A)

Domain session cookie resolution during AAA authentication is resolved by ensuring the resources involved are addressed by domain-based names that the client can consistently use. The recommended approach is to configure DNS so that the authentication and traffic management virtual servers are assigned fully qualified domain names (FQDNs) that exist in the domain. When the browser receives a cookie during AAA and those cookies are scoped to the same domain name the client is visiting, the cookie is sent back to the correct virtual server on subsequent requests, preserving the session and avoiding cross-domain cookie issues.

This works better than simply giving the NetScaler an FQDN on the domain, because the cookie’s domain scope typically depends on the exact host name the user accessed and the corresponding DNS name mapping for the authentication and TM virtual servers. DNS changes that try to influence cookie behavior by tweaking cookie timeouts or by naming the cookie itself aren’t applicable, so those options don’t address the resolution problem.