Firewall DNS Operation Question

Question

Hello All,

We have noticed in our SIEM that we are receiving an insane amount of DNS logs from our Fortigates for some specific domains.

These are:

update.microsoft.com swscan.apple.com softwareupdate.vmware.com play.google.com autoupdate.opera.com auth.gfx.ms

I know that these are some default domains in the firewall - I believe that they may be defaulted as SSL decryption ignore. (but not 100% positive)

My real question is how to have the Fortigates stop sending SIEM millions of these events every day and why are these domains specifically doing it? Is something misconfigured??

Thanks!

petertavenier · Answer

Got this same issue and found this old question.

softwareupdate.vmware.com and auth.gfx.ms where the one my DNS server noticed. I'm not using the default SSL deep-inspection profile, but I'm also not able to remove it (FortiGate-30D). I noticed the TTL is very short (20 seconds) on this two domains.

# diagnose test application dnsproxy 6
worker idx: 0
vfid=0 name=auth.gfx.ms ver=IPv4 timer running,  min_ttl=20:4, cache_ttl=0 , slot=-1, num=1
         95.101.59.100 (ttl=20:10:10)
vfid=0 name=softwareupdate.vmware.com ver=IPv4 timer running,  min_ttl=9:4, cache_ttl=0 , slot=-1, num=1
         2.17.220.33 (ttl=9:9:9)
## filtered

this link might help;

https://kb.fortinet.com/kb/documentLink.do?externalID=FD32406

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded