Skip to main content
JerryPWhite1
JerryPWhite1
Explorer
January 5, 2021
Solved

Benefit of DNS database!!!

  • January 5, 2021
  • 2 replies
  • 6949 views

What would be the benefit of the DNS database set as slave? Thanks in advance.

    Best answer by ede_pfau

    1- if used as a gateway firewall, the FGT should be the only DNS used on all protected LANs, as Best Practise. It uses a trusted external DNS, the ISP's. But, as a drawback, it will not resolve local names.

    Usually, the local DNS database is kept on a Windows server (as it supports dynamic DNS, which the FGT does not). Mirroring the server's DNS to the FGT allows to use the FGT as the authoritative DNS of it's LANs.

     

    2- the FGT will cache DNS requests, vastly accelerating DNS requests. It will do so in any DNS configuation, including being used as DNS slave, but this aspect makes using the FGT as DNS even more attractive.

    2 replies

    ede_pfau
    SuperUser
    ede_pfauAnswer
    SuperUser
    January 5, 2021

    1- if used as a gateway firewall, the FGT should be the only DNS used on all protected LANs, as Best Practise. It uses a trusted external DNS, the ISP's. But, as a drawback, it will not resolve local names.

    Usually, the local DNS database is kept on a Windows server (as it supports dynamic DNS, which the FGT does not). Mirroring the server's DNS to the FGT allows to use the FGT as the authoritative DNS of it's LANs.

     

    2- the FGT will cache DNS requests, vastly accelerating DNS requests. It will do so in any DNS configuation, including being used as DNS slave, but this aspect makes using the FGT as DNS even more attractive.

    emnoc
    emnoc
    New Member
    January 5, 2021

    But DNS should be on dns-servers and not a firewall imho and more so if you have internal and external edge firewalls. A proper design server hosted dns with split-views out weighs anything that the fortigate can do.

     

    Ken Felix

     

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    January 6, 2021

    sure, aggree. What I've outlined refers to setups with one (border) firewall only. The point I was trying to make is that an external DNS needs to be trusted, and that the FGT knows one. I usually block all DNS from internal to internet as the hosts should use the (Windows server) internal DNS which in turn uses the FGT as external DNS.

    Gabrielhm
    Gabrielhm
    New Member
    January 18, 2021

    Personal choice, mostly. Both versions will work just fine.

    You can only forward to their services if you are okay with Cloudflare/Google DNS/OpenDNS knowing every domain you visit and potentially doing bad stuff with that knowledge. In general, they are quicker than querying the root servers directly. Querying root servers enables you to bypass a single entity that has all your queries (except your ISP), however traffic can not be encrypted, whereas DNS over TLS is already provided by Cloudflare (probably Google too).

    DNSSEC is useless since it does not have encryption, it just verifies the response of the server.

    Terms & ConditionsAccessibility statement