Fortigate as DNS server

Forum|Forum|5 years ago
October 10, 2020
4 replies
7523 views

Is it possible to make the following happen on a FortiGate?

DNS 10.16.0.1 would be an internal DNS server on the Fortigate 80F. Clients would be able to resolve other local clients using the Fortigate. If the DNS is a public DNS, then the FortiGate would use Fortiguard DNS servers to resolve. I've had this setup before on other devices such as Ubiquiti (EdgeRouters), SonicWalls, NetGear devices but for some reason the only documentation I can find is if I want to point my clients to an internal Windows/Linux DNS server.

Thanks in advance

DNS.jpg

lobstercreed

New Member

I've never done it, but I'm pretty sure it's possible. Have you checked out this cookbook?

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/960561/fortigate-dns-server

TheUsDAuthor

Visitor III

lobstercreed wrote:
I've never done it, but I'm pretty sure it's possible. Have you checked out this cookbook?

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/960561/fortigate-dns-server

So I should have followed up with this sooner...I ended up just calling support and getting their feedback:

"You can create local DNS servers for your network. Depending on your requirements, you can either manually maintain your entries (master DNS server), or use it to refer to an outside source (slave DNS server)." ...Answered the question but I had to hear it from them.

Basically, if you want to enter in ALL your DNS entries manually then it can be your local DNS server which is no good if you have DHCP clients in a subnet or vlan with DHCP turned on. However, because the FortiGate is still considered a FIREWALL (though it is basically a router) and thus does not have an internal auto DNS population database functionality. Therefore, you will still need an Windows / Linux DNS server. Honestly, I think this is a huge off-set and a complete miss on FN's part. With so much power and dedicated resources combined with a superior GUI/CLI, I cannot understand why the drew the line at this having an internal DNS server that has the capability to create A records on its own. Even the small fries like SonicWally, EdgeRouter (Ubiquiti), Netgear and Linksys can accomplish this. Anyways, I am considering the subject closed and sadly resolved.