Troubleshooting Tip: Identifying and solving a DNS issue while provisioning a FortiToken

Sometimes, when trying to assign a FortiToken to the users in FortiGate, a 'FortiCare Unreachable' message may appear.

One possible cause of this error is the DNS being unable to resolve the hostname.

Perform a ping test in FortiGate:

execute ping fds1.fortinet.com
execute ping directregistration.fortinet.com

The ping will fail with the message 'unable to resolve hostname'.

Run the debug commands below and simultaneously ping the FQDN 'directregistration.fortinet.com' on FortiGate.

In CLI session 1:

execute ping directregistration.fortinet.com

In CLI session 2:

diagnose debug reset

diagnose debug application dnsproxy -1
diagnose debug console timestamp enable

diagnose debug enable

Disable the debugging steps afterwards:

diagnose debug disable
diagnose debug reset

The DNS debug result will show output similar to the following.

Output from DNS debug:

last_tx=0 ftg_last_tx=0 domain=directregistration.fortinet.com (orig id: 0x0000 local id:0x0000 active)
[worker 0] dns_send_request()-1302
[worker 0] dns_query_get_local_id()-352: Cannot find local id (number of queries: 18)

Cannot find local ID in the output means it is not releasing the local-ID resource.

To resolve this, restart the DNS proxy by using the following command:

diagnose test application dnsproxy 99

Additionally, kill the process with or without the PID:

diagnose sys process pidof dnsproxy
<pid>
diagnose sys kill 11 <pid>

Or:

fnsysctl killall dnsproxy

Once the DNS proxy daemon has been restarted, perform a ping test again. This time, it should be successful. The FortiTokens can then be provisioned to the intended users.

Related article:
Technical Tip: FortiGate Troubleshooting DNS commands