Skip to main content
acvaldez
Staff
acvaldez
Staff
April 8, 2022

Technical Tip: How to configure Dynamic DNS for FortiGate

  • April 8, 2022
  • 0 replies
  • 91697 views

Description

This article describes how to configure Dynamic DNS for FortiGate.

Scope

FortiGate.

Solution

Diagram:

acvaldez_0-1649403613656.png


In the FortiGate GUI, go to Network -> DNS -> Enable FortiGuard DDNS, select the interface with the dynamic connection, select the server that is linked to the account, and enter 'Unique Location'.
 

acvaldez_1-1649403613660.png

 
Note: It is not mandatory to use DNS Protocol = TLS for DDNS to function.


DDNS works correctly with:

  • Traditional DNS (UDP/53).

  • DNS Proxy.


DNS over TLS is recommended as a security best practice, but it is not a specific requirement for DDNS.

DDNS traffic toward FortiGuard is already encrypted (HTTPS), regardless of whether DNS over TLS is enabled or disabled.

From the CLI:

config system ddns
    edit 101
        set ddns-server FortiGuardDDNS
        set ddns-domain "fgtbacoor.fortiddns.com"
        set use-public-ip enable
        set monitor-interface "wan1"
    next
end

 

Available domains on FortiGuard DDNS:

  • fortiddns.com

  • fortidyndns.com

  • float-zone.com

 

Run an 'nslookup' operation for the 'fgtbacoor.fortiddns.com' domain. It will resolve to whatever public IP the FortiGate is getting translated into.

 

acvaldez_2-1649403613669.png

 

acvaldez_3-1649403613670.png

 

After configuring, if the DDNS is not working, take the debug commands output below and open a TAC ticket, and update the debug output for TAC investigation. 

diagnose debug disable
diagnose debug reset
diagnose debug application ddnscd -1
diagnose debug enable 

 

To stop the debug processes after using them, press Ctrl + C and enter 'diagnose debug disable'.

 

Note:

  • DDNS can only be configured via CLI for FortiGate VMs. Configuring DDNS via GUI is not supported for FortiGate-1000 series or higher or FortiGate-VM.

  • Configuring DDNS via GUI is not supported when the configured DNS server is not using FortiGuard Servers. FortiGate does not support DDNS when in transparent mode.

  • By default, one DDNS can be configured through the GUI. If it is necessary to configure multiple DDNS, configure them through the CLI.

  • The 'use-public-ip' option is only available when 'ddns-server' is set to 'FortiGuardDDNS'.

  • When configuring a FortiGuardDDNS domain in a High Availability (HA) cluster, the same entry is valid for both devices. When a failover event occurs, the ddnscd daemon will communicate with FortiGuard and trigger a removal request of the entry from the primary serial number to the secondary (new primary) serial number. 

  • If it is necessary to delete a FortiGuardDDNS entry due to a migration for a new device, raise a TAC ticket with the serial number of the device that currently holds the DNS Records. This ticket will have to be created from the account that owns the FortiGate Appliance: Support.

  • In rare cases when a public IP is already configured in the FortiGate interface and the 'use-public-ip' option is still enabled, the DDNS may resolve to a different public IP and not to the configured public IP in the FortiGate WAN interface. If this happens, disable the 'use-public-ip' option in the DDNS settings.


In the following situation, keep in mind that the public IP is still managed by the ISP (Internet Service Provider) and check for any blockers to port forwarding:

  • The FQDN shows the Public IP of the ISP after creating all of the configurations and with an nslookup.

  • There is still no communication to services.

  • The VPN setup (SSL - IPsec) does not come up, or a sniffer catches no traffic on the FortiGate coming from the WAN (or the upstream device giving Internet).

This is necessary to configure on the router managing the Public IP address to ensure all of the queries are properly forwarded to the FortiGate.

 

Note:

It is not possible to use the same DDNS on multiple FortiGates. In this case, the device is replaced and it is necessary to use the same DDNS. Open a ticket with Fortinet Support so the TAC team can remove the DDNS mapping from the old device. Then the configuration needs to be applied in the new device.


Note:

There is an ongoing issue with DDNS. If the FQDN resolution does not reflect the correct public IP, run this to fix it:

config system fortiguard
    set fortiguard-anycast disable
    set ddns-server-ip 173.243.138.225
end


For DDNS using third-party DDNS service, refer to Technical Tip: How to configure a third party DDNS service.

Related documents:

      Terms & ConditionsAccessibility statement