Technical Tip: Unable to load FortiGuard DDNS server list
Description
This article describes how to use the DDNS service and how to enable FortiGuard DDN servers when the following error message appears from the GUI:
Scope
FortiGate.
Solution
If there is a PPPoE or DHCP connection on the WAN port, make sure the overriding internal DNS is disabled:
From the GUI, go to Network -> Interfaces, edit WAN, and unselect Override internal DNS.
From CLI/SSH:
config system interface
edit wan1
set dns-server-override disable
end
Manually configure the DDNS server via CLI/SSH:
config system fortiguard
set ddns-server-ip 173.243.138.225
end Change the protocol to UDP and disable FortiGuard Anycast (for version 6.4.2).
config system fortiguard
set fortiguard-anycast disable
set protocol udp
end
If an issue is found in FortiOS v7.0 with FortiDDNS, make the changes below:
config system fortiguard
set fortiguard-anycast disable
set ddns-server-ip 173.243.138.226
endFortiGate will be able to reach FortiGuard services. Ping the following domains:
execute ping service.fortiguard.net
execute ping update.fortiguard.net
execute ping guard.fortinet.netexecute ping securewf.fortiguard.net (HTTPS)
execute ping usservice.fortiguard.net (UDP - USA servers)
execute ping ussecurewf.fortiguard.net (HTTPS - USA servers)execute ping globalupdate.fortinet.net
execute ping globalguardservice.fortinet.net
execute ping globallogctrl.fortinet.net
execute ping globalmgrctrl.fortinet.net
execute ping globalmsgctrl.fortinet.net
execute ping globalaptctrl.fortinet.net
execute ping globalproductapi.fortinet.net
Where:
'globalupdate.fortinet.net" <----- Object download server.
'globalguardservice.fortinet.net" <----- Querying service server (webfiltering, antispam).
'globallogctrl.fortinet.net" <----- FortiGate Cloud logging server.
'globalmgrctrl.fortinet.net" <----- FortiGate Cloud management server.
'globalmsgctrl.fortinet.net" <----- FortiGate Cloud messaging server.
'globalaptctrl.fortinet.net" <----- FortiGate Cloud sandbox server.
'globalproductapi.fortinet.net" <----- Product API server used by OCVPN registration and GUI icon download.
Check the Maximum Transmission Unit (MTU) allowed on the internet connection.
Configure the MTU on the interface used for external connection, following the article Technical Tip: How to adjust the Maximum Transmission Unit (MTU) value.
execute ping-options df-set yes
execute ping-options data-size <MTU size>
execute ping 8.8.8.8
This is due to a handshake failure for TLSv1.3, which will be resolved if the above changes are made.
Note: If it is under multiple VDOMs, configure the setting below on the FortiGuard server:
config system fortiguard
set fortiguard-anycast enable
set ddns-server-ip 173.243.138.225
end
Additional context information:
About the DDNS default service: Currently, there are two FQDNs for the DDNS service.
When Anycast is disabled, FQDN 'ddns.fortinet.net' (resolved to 173.243.138.226) will be used. When Anycast is enabled, FQDN 'globalddns.fortinet.net' (resolved to 173.243.138.225) will be used.
Note:
If the Administrator disables FortiGuard Anycast:
config system fortiguard
set fortiguard-anycast disable
end
Make sure to enter the IP address 173.243.138.226 as ddns-server-ip in FortiGuard settings.
config system fortiguard
set fortiguard-anycast disable
set ddns-server-ip 173.243.138.226
end
The connection will not work if 173.243.138.225 remains configured.
Related articles:
