Technical Tip: External DNS resolution stops working when using DNS Filter profile after HA Failover in FortiGate Active-Passive Clusters

Description

This article describes a solution to resolve DNS filter issues that occur after a High Availability (HA) failover in FortiGate Active-Passive clusters, causing internet outages for internal users.

Scope

FortiGate.

Solution

When using a DNS Filter profile in a firewall policy, after an HA failover to the passive device, all external DNS resolution stops working immediately after the failover, resulting in an internet outage for internal users.

To resolve the DNS filter issue after HA failover in FortiGate Active-Passive clusters, follow these steps:

1. There should be seamless connectivity between FortiGate and FortiGuard SDNS Servers. Refer to this document Troubleshooting for DNS filter.
2. If the connection is fine, check for DNS Query logs for denied traffic, Crashlog Read for any crashes, HA History to know if any issues with failover process.
3. If there is nothing significant related to the issue, try changing the FortiGuard settings between Anycast and Unicast Servers. 
4. An example configuration is provided below, pertaining to FortiGuard Anycast and Unicast settings:

config system fortiguard

    set fortiguard-anycast enable

end

config system fortiguard

    set fortiguard-anycast disable

    set sdns-server-ip 208.91.112.220 173.243.140.53 210.7.96.53

end

5. If the issue persists, consider clearing the DNS cache and restarting the DNSProxy process. 

diagnose test application dnsproxy 1

diagnose test application dnsproxy 99

If there are any issues with the DNSproxy process, restarting it fixes the issue.