DNS Filter Policy not working in Flow Mode Inspection - Has to be Proxy Mode
Hello! I just migrated most of the policies on a customer's 600E (7.4.8) from Proxy mode to Flow mode since only a few of the policies actually needed the Proxy mode to work (CDR & Video Filtering). One of the rules that I tried to change from Proxy mode to Flow mode was a simple DNS rule that only does DNS filtering for DNS lookups to the Internet:
config firewall policy edit 117 set name "DNS Filter - Testing" set uuid b4130862-7872-51f0-6074-01eb3ef19f90 set srcintf .... set dstintf "virtual-wan-link" set action accept set srcaddr "laptop wifi" set dstaddr "all" set schedule "always" set service "DNS" set utm-status enable set inspection-mode proxy set dnsfilter-profile "DNS-Filter" set logtraffic all set nat enable next endWhen I change this rule to Flow, a select few DNS lookups resolve to FortiGuard's DNS Blocking page. Yet, when I do these same DNS lookups using Proxy mode, they work just fine. Here is an example of my nslookups:
Flow Mode: C:\Users\dell>nslookup shop.bergeystruck.com. 8.8.8.8 Server: dns.google Address: 8.8.8.8 Non-authoritative answer: Name: shop.bergeystruck.com Addresses: 2620:101:9000:53::55 208.91.112.55 <-- FortiGuard DNS Blocking> Proxy Mode: C:\Users\dell>nslookup shop.bergeystruck.com. 8.8.8.8 Server: dns.google Address: 8.8.8.8 Non-authoritative answer: Name: shop.bergeystruck.com Address: 104.211.61.142 <--- correct web page>
Anyone with any idea of why this is happening? This doesn't make any sense to me. The DNS Filter enforces SafeSearch, allows all categories [other than Malicious Websites], and has a few Static Domain Filters.
I appreciate any input!
