Technical Tip: Unable to load FortiGuard DDNS server list

Description

This article describes how to use the DDNS service and how to enable FortiGuard DDN servers when the following error message appears from the GUI:

Scope

FortiGate.

Solution

1. If there is a PPPoE or DHCP connection on the WAN port, make sure the overriding internal DNS is disabled:

• From the GUI, go to Network -> Interfaces, edit WAN, and unselect Override internal DNS.

• From CLI/SSH:

config system interface
    edit wan1
        set dns-server-override disable
end

2. Manually configure the DDNS server via CLI/SSH:

config system fortiguard
    set ddns-server-ip 173.243.138.225
end 

3. Change the protocol to UDP and disable FortiGuard Anycast (for version 6.4.2).

config system fortiguard
    set fortiguard-anycast disable
    set protocol udp
end

4. If an issue is found in FortiOS v7.0 with FortiDDNS, make the changes below: 

config system fortiguard
    set fortiguard-anycast disable
    set ddns-server-ip 173.243.138.226
end

5. FortiGate will be able to reach FortiGuard services. Ping the following domains:
   
   

execute ping service.fortiguard.net
execute ping update.fortiguard.net
execute ping guard.fortinet.net

execute ping securewf.fortiguard.net (HTTPS)
execute ping usservice.fortiguard.net (UDP - USA servers)
execute ping ussecurewf.fortiguard.net (HTTPS - USA servers)

execute ping globalupdate.fortinet.net  
execute ping globalguardservice.fortinet.net 
execute ping globallogctrl.fortinet.net 
execute ping globalmgrctrl.fortinet.net 
execute ping globalmsgctrl.fortinet.net 
execute ping globalaptctrl.fortinet.net 
execute ping globalproductapi.fortinet.net  

Where:

'globalupdate.fortinet.net" <----- Object download server.
'globalguardservice.fortinet.net" <----- Querying service server (webfiltering, antispam).

'globallogctrl.fortinet.net" <----- FortiGate Cloud logging server.

'globalmgrctrl.fortinet.net" <----- FortiGate Cloud management server.

'globalmsgctrl.fortinet.net" <----- FortiGate Cloud messaging server.

'globalaptctrl.fortinet.net" <----- FortiGate Cloud sandbox server.

'globalproductapi.fortinet.net" <----- Product API server used by OCVPN registration and GUI icon download.

6. Check the Maximum Transmission Unit (MTU) allowed on the internet connection.
   Configure the MTU on the interface used for external connection, following the article Technical Tip: How to adjust the Maximum Transmission Unit (MTU) value.
   
   

execute ping-options df-set yes
execute ping-options data-size <MTU size>
execute ping 8.8.8.8

This is due to a handshake failure for TLSv1.3, which will be resolved if the above changes are made.

Note: If it is under multiple VDOMs, configure the setting below on the FortiGuard server:

config system fortiguard
    set fortiguard-anycast enable
    set ddns-server-ip 173.243.138.225
end

Additional context information:

• About the DDNS default service: Currently, there are two FQDNs for the DDNS service.

• When Anycast is disabled, FQDN 'ddns.fortinet.net' (resolved to 173.243.138.226) will be used. When Anycast is enabled, FQDN 'globalddns.fortinet.net' (resolved to 173.243.138.225) will be used.

Note:

If the Administrator disables FortiGuard Anycast:

config system fortiguard
    set fortiguard-anycast disable
end 

Make sure to enter the IP address 173.243.138.226 as ddns-server-ip in FortiGuard settings.

config system fortiguard
    set fortiguard-anycast disable
    set ddns-server-ip 173.243.138.226
end

The connection will not work if 173.243.138.225 remains configured.

Related articles:

• Technical Tip: How to update IP address with FortiGuard DDNS service and upstream router

• Troubleshooting Tip: FortiGuard DDNS IP update fails