DNS Server

Question

I have two Fortigate devices: FG1 and FG2. There's a tunnel between them, with a computer connected to the LAN port on FG1 and a file server on FG2. I would like FG1 to resolve the domain to an IP address, which is why I set up a DNS server on FG1. Now, the question is: what should I enter in the DNS Forwarder, and should I check "authoritative"? I don't know what that means, but I think I should check it because I don't want the query to go to the internet, but rather to stay within my network.

The DNS forwarder is set to 8.8.8.8, and it works, but I don't know why. If I set the DNS forwarder to 8.8.8.8, I understand that addresses not found in the local database will go to the internet. But why does it work if I'm setting up a new zone? Shouldn't this option be in DNS Service on the interface, not in the DNS database? And when I add a second zone because I want it to resolve another domain, what should I enter in the DNS forwarder? When I leave it blank, everything still works, including public DNS (like Google's) as well as the local one I configured.

How does this work exactly? I can't find a clear explanation anywhere, and what should I do according to your advice?

Bigdog · Accepted Answer

For the DNS Forwarder

This is where unmatched queries are sent (e.g., google.com or any domain you haven’t defined locally).

Setting this to 8.8.8.8 means: "Send all unknown DNS queries to Google Public DNS."
You don't need to set this for zones you’ve defined locally and marked as authoritative.

This lets clients connected to FG1 (like the LAN computer) use the FortiGate as their DNS server. Without enabling DNS service on that interface, FG1 won’t respond to client DNS requests.

ebilcari · Answer

Usually you don't need to configure the 'DNS Forwarder' inside the zone. It is used only when a specific forwarder is needed for that zone, the details are shown in this section of the guide. The most important part in your question I guess is related to the Mode which is set to Recursive by default which means that the domain will be searched firstly in the local DNS database and if it is not found than the system DNS will be queried.

Sign up

Login with SSO

Login to the community

Login with SSO