Technical Tip: No DNS Query Logs on FortiGate when using a VIP to access the DNS server

When FortiGate has a DNS service enabled on an interface, and clients access the DNS server using a Virtual IP on the FortiGate, no DNS query log is generated. Although no log is generated, the FortiGate's DNS service receives the query and responds as configured.

Sample Configuration:

config system interface
    edit "dns-loopback"
        set vdom "vdom1"
        set ip 10.100.100.1 255.255.255.0
        set allowaccess ping ssh telnet
        set type loopback
        set role lan
    next
end

config system dns-server
    edit "dns-loopback"
        set mode forward-only
        set dnsfilter-profile "dnsfilter_fgd"
    next
end

config firewall vip
    edit "DNS_vip"
        set service "ALL"
        set extip 10.1.100.2
        set mappedip "10.100.100.1"
        set extintf "port1"
    next
end

config firewall policy
    edit 1
        set name "vip"
        set srcintf "port1"
        set dstintf "dns-loopback"
        set action accept
        set srcaddr "all"
        set dstaddr "DNS_vip"
        set schedule "always"
        set service "ALL"
        set nat enable
    next
end

This issue has been resolved in FortiOS version 7.6.1.