Skip to main content
fsmar
fsmar
New Member
July 18, 2018
Question

Fortigate DNS slaves

  • July 18, 2018
  • 1 reply
  • 4103 views

Hi all,

 

I am trying to achieve something relatively simple but its not working for me:

 

I want my fortigate to act as the DNS server for my machines so i have set the nameserver on them to point to the firewall IP. 

 

The problem i am having is now i have a domain "mycompany" so if i try to resolve "myserver.mycompany" from one of my machines it doesnt work. The request appears to go "outside" and not to my internal DNS server.

[ul]
  • I have an internal DNS server (dnsmasq), this is working without problems, i can "dig" directly to it and i get good resolutions. also there are no local firewalls blocking anything
  • The DNS on the interface is set to be "Recursive"
  • I have made a "DNS Database" with type "Slave" and view "Shadow"  and set the IP of the master to my internal DNS server
  • I have sniffed the traffic and i see no requests going to my internal DNS server[/ul]

     

    What can be the problem here?

     

      • 1 reply

      sw2090
      SuperUser
      sw2090
      SuperUser
      July 19, 2018

      fsmar: what I get is this: you have an internal DNS server which is working fine but you want your clients to use your FGT as DNS. 

       

      If you internal DNS is also resolving non local FQDNs and you don't need zones on the FGT you could set your FGT to do DNS Forwarding to your internal DNS Server instead. Then you could use the FGT als DNS Server on your clients and it will forward all requests to your internal DNS then. 

       

      if this is not possible you could probably enable the fgt dns to do zone transfer with your internal DNS to be able to resolve you internal things. However I never needed this and so I don't know if and how that is possible on a FGT.

       

      What you wrote is the default behaviour:

       

      DNS gets the request and notices that it don't have zone for this domain (not authoritative) so it will forward this to the internet like you wrote to resolve it but since this is not an external FQDN will not find any authoritative DNS out there so will fail ;)

      Terms & ConditionsAccessibility statement