Explorer III

Solved

Fortigate as DNS server for FortiNAC

6 replies
368 views

Hello everyone,

I would like to know if it's possible to use Fortigate as a DNS server for the Isolation network in the config wizard of FNAC?

Screenshot 2026-02-11 155750.png

Thanks in advance.

BR,

ebilcariAnswer

Staff

Yes, the list is already populated with the most common domains, and additional ones can also be added. Keep in mind that this applies only to DNS resolution, the network (routing) and security policies must also allow this communication.
If the FGT is configured as a fully functional DNS server, then yes, it can be used.

Emirjon

magliano

Staff

Hi @ByteHaven,

If you prefer to do so for a specific objective, you may proceed. However, ideally, FortiNAC itself should be configured as the DNS server.

May I ask the reason why you would like to use the FortiGate instead of FortiNAC as the DNS server?

Best regards,

ByteHavenAuthor

Explorer III

Hello Gustavo,

No, of course I'm gonna use FortiNAC as DNS server for isolated users, but to do so you need to configure an A record on the internal DNS server to point to the FortiNAC's IP add, so the captive portal would work.

So I thought I could configure the A record on the Fortigate instead of a DNS server, and on the FortiNAC config wizard I use Fortigate as DNS server (this is for testing purposes, as in a lab environment)

Screenshot 2026-02-12 104443.png

BR,

ebilcari

Staff

This configuration in ConfigWizard is used by the Allowed Domains feature and is required to resolve the domains that are on the list to their actual IPs. Since these domains are typically public domains (OS updates, antivirus services, etc.), the DNS server specified here must be able to resolve them.

These DNS servers will not be visible to the isolated hosts. Any DNS server that is reachable from FNAC can be used here.

Emirjon

ByteHavenAuthor

Explorer III

Hi Emirjon,

I did not know about this part, this is very detailled and interesting.

So this part shows the DNS server's available/reachable services, and you can specify which domain the isolated host can access ?

Do you think I can use my Fortigate as a prod DNS server ?

BR,

ebilcariAnswer

Staff

Yes, the list is already populated with the most common domains, and additional ones can also be added. Keep in mind that this applies only to DNS resolution, the network (routing) and security policies must also allow this communication.
If the FGT is configured as a fully functional DNS server, then yes, it can be used.

Emirjon

Sign up

Login with SSO

Login to the community

Login with SSO