Skip to main content
Tristan_Cober
Tristan_Cober
New Member
October 21, 2020
Question

6.4.2 Web Filtering/DNS filtering license

  • October 21, 2020
  • 1 reply
  • 14051 views

Standing up a new 40f and was testing out the connection to make sure everything was good before boxing it up, and was unable to browse once DNS filter was enabled. DNS status page shows the DNS Filter Server as Unreachable. Originally was using 173.243.140.16, and changed to 208.91.112.220 to confirm it wasn't just one server. When looking at the DNS filter settings, the service license appears to be blank/unset. Web Filtering is definitely licensed though.

 

Is there anything I can check that I might have missed? It's a pretty vanilla setup. None of the docs seem to line up with how the output looks.

 

# diag test app dnsproxy 3 worker idx: 0 vdom: root, index=0, is master, vdom dns is enabled, mip-169.254.0.1 dns_log=1 tls=0 cert=Fortinet_Factory dns64 is disabled dns-server:208.91.112.53:53 tz=0 tls=0 req=62 to=0 res=62 rt=1 ready=1 timer=0 probe=0 failure=0 last_failed=0 dns-server:208.91.112.52:53 tz=0 tls=0 req=57 to=0 res=57 rt=1 ready=1 timer=0 probe=0 failure=0 last_failed=0 sdns-server:208.91.112.220:853 tz=0 tls=2 req=0 to=0 res=0 rt=1493 ready=0 timer=431 probe=9 failure=0 last_failed=0 Interface selecting method: auto Specified interface: FortiGuard interface selecting method: auto FortiGuard specified interface: DNS_CACHE: hash-size=2048, ttl=1800, min-ttl=60, max-num=5000 DNS FD: udp_s=10 udp_c=25:26 ha_c=30 unix_s=11, unix_nb_s=31, unix_nc_s=12 v6_udp_s=9, v6_udp_c=28:29, snmp=32, redir=21, v6_redir=22 DNS FD: tcp_s=13, tcp_s6=14, redir=33 v6_redir=34 FGD_DNS_SERVICE_LICENSE: server=208.91.112.220:853, expiry=0000-00-00, expired=1, type=0 FGD_CATEGORY_VERSION:8 SERVER_LDB: gid=eec0, tz=-420, error_allow=0 FGD_REDIR_V4:FGD_REDIR_V6:

 

 

 

# get system fortiguard fortiguard-anycast : enable fortiguard-anycast-source: fortinet protocol : https port : 443 load-balance-servers: 1 auto-join-forticloud: enable update-server-location: any sandbox-region : antispam-force-off : disable antispam-cache : enable antispam-cache-ttl : 1800 antispam-cache-mpercent: 2 antispam-license : Contract antispam-expiration : Sun Oct 17 2021 antispam-timeout : 7 outbreak-prevention-force-off: disable outbreak-prevention-cache: enable outbreak-prevention-cache-ttl: 300 outbreak-prevention-cache-mpercent: 2 outbreak-prevention-license: Contract outbreak-prevention-expiration: Sun Oct 17 2021 outbreak-prevention-timeout: 7 webfilter-force-off : disable webfilter-cache : enable webfilter-cache-ttl : 3600 webfilter-license : Contract webfilter-expiration: Sun Oct 17 2021 webfilter-timeout : 15 anycast-sdns-server-ip: 208.91.112.220 anycast-sdns-server-port: 853 sdns-options : source-ip : 0.0.0.0 source-ip6 : :: proxy-server-ip : 0.0.0.0 proxy-server-port : 0 proxy-username : proxy-password : * ddns-server-ip : 0.0.0.0 ddns-server-port : 443 interface-select-method: auto

    1 reply

    Tristan_Cober
    Tristan_CoberAuthor
    New Member
    November 5, 2020

    Just updating that this was noted as being fixed in 6.4.3, and can confirm it seems to be functioning as expected on 6.4.3.

    mike_dp
    mike_dp
    New Member
    December 15, 2020

    I have the same issue on 6.4.4 80F

    andrewbailey
    andrewbailey
    New Member
    December 16, 2020

    Hi Trsitan and mike,

     

    I've spent quite a bit of time fiddling about with this too. I'm currently running 6.4.4 on a Fortigate 60E, not using the Fortiguard DNS servers (using my ISP DNS servers) and enforcing DNS over TLS.

     

    The new prefered option seems to be the anycast network (listed as the "deafult Fortiguard access mode" in the 6.4.4 admin guide). 

     

    The Fortigaurd anycast servers were enabled in FortiOS sometime back- but I got the impression the anycast servers were still being rolled out in the background? Certainly my experience suggested it was perhaps not completely deployed.

     

    I had fallen back to anycast disabled (ie using non-anycast) and using HTTPS over port 8888. That seemed to be reliable and stable for me in terms of SDNS and etc.

     

    This thread prompted me to have another look at anycast and see if I could get it working.

     

    I was just checking the Admin guide on the docs page and see that it does list "Anycast and unicast services" (https://docs.fortinet.com/document/fortigate/6.4.0/ports-and-protocols/622145/anycast-and-unicast-services).

     

    This reference states Secure DNS as being on the anycast domain name of "globalsdns.fortinet.net". For me (near London UK) that resolves too 173.243.140.53.

     

    So, if I try the following config:-

     

    config system fortiguard     set fortiguard-anycast enable     set fortiguard-anycast-source fortinet     set protocol https     set port 443     .......     set anycast-sdns-server-ip 0.0.0.0     set anycast-sdns-server-port 853     ....... end

     

    That seemed to work initially. But I can see from "diag test app dnsproxy 3" the "licence" issue Tristan noted. Further, this link in the admin guide (https://docs.fortinet.com/document/fortigate/6.4.4/administration-guide/150448/troubleshooting-for-dns-filter) seems to confirm this config isn't working for SDNS.

     

    On the positive side with this configuration (using anycast) shows really good ping times to the "web filter" and "outbreak prevention" servers of about 19ms (previously had been up to 180ms). The IP address indicated is 173.243.140.16 (which the globalguardservice.fortinet.net shown in the reference above resolves too).

     

    So, how did you get it all working Tristan? Are you able to share you final config perhaps?

     

    I might raise a ticket and ask some quesiton about this too.

     

    Kind Regards,

     

     

    Andy.

    Terms & ConditionsAccessibility statement