Skip to main content
topcu
topcu
Explorer
June 28, 2022
Question

DNS Split: resolve internal and external names local on the fortigate on different servers?

  • June 28, 2022
  • 1 reply
  • 2505 views

Hello all,

this request regards to DNS name resolution on the fortigate local only!

 

The configuration of the firewall was changed to per-VDOM dns, because FQDN objects in that vdom should be resolved by an external nameserver. But unfortunately this leads to problems with the resolution of configured firewall users. The fortigate needs to resolve names for the following purposes:

1. Names of local configured servers (LDAP, RADIUS, etc)

2. Names from configured FQDN policy objects

 

1. must be resolved from the internal nameserver

2. should be resolved from an external nameserver

 

Is there a way to fix this?

 

Version 6.2.2

 

Many thanks in advance. Regards, Hakan

1 reply

pa_iva
pa_iva
New Member
June 29, 2022

Hi,

 

You can define the primary dns server as your internal nameserver, define the local domain name, and use as secondary an external DNS server:

 

DNS settingsDNS settings

DNS resolution internal/externalDNS resolution internal/external

topcu
topcuAuthor
Explorer
July 1, 2022

Hi pa_iva, many thanks for your reply.

Yes, actually this works. I built this in a lab and did packet captures. The Fortigate is always asking both, the primary and secondary, regardless which domain is asked, and it will get an answer of one of both servers. But with this configuration I would loose the redundancy of the namservers. Means, if the primary fails, resolution of internal names would fail. Even if this works, I cannot implement this in our productive network.

 

Best regards, Hakan

Terms & ConditionsAccessibility statement