Skip to main content
Mirza_Asad2723
Mirza_Asad2723
New Member
January 20, 2025
Solved

FortiGate DNS Status Showing in RED with High ms

  • January 20, 2025
  • 2 replies
  • 4242 views

Dear Concern,

 

I am using FortiGuard as the DNS server on my FortiGate, but today its status is showing as RED with high latency, as shown in the pasted capture.

 

Capture.JPG01.JPG

 

 

Previously, it was showing GREEN. Additionally, when I use Google's DNS like 8.8.8.8 or 8.8.4.4, it shows unreachable, as shown in pasted capture.

Capture.JPG02.JPG

 

I have checked the internet, and it is working perfectly with proper browsing through the same ISPs that are terminated on the firewall.

 

My Second Testing, When I use Google's DNS server on FortiGate, like 8.8.8.8 or 8.8.4.4, these IP addresses are pinging from the FortiGate CLI without any packet loss while in DNS Tab in FortiGate firewall showing unreachable as mentioned in above picture.

Capture.JPG04.JPG

 

However, when I ping a domain name like google.com, it doesn't work, meaning the DNS is not resolving.

Capture.JPG05.JPG

 

Then, when I bypass the FortiGate firewall and check by directly connecting the ISP link to my laptop, both the IP address and the domain name are pinging successfully.

 

Kindly help me diagnose and resolve this issue.

Best answer by srajeswaran

Looks like the UDP port 53 communication is blocked.

Can you try changing to TCP and check?

image.png

Do you have any local-in policies configured?

show firewall local-in-policies

2 replies

srajeswaran
Staff
srajeswaranAnswer
Staff
January 20, 2025

Looks like the UDP port 53 communication is blocked.

Can you try changing to TCP and check?

image.png

Do you have any local-in policies configured?

show firewall local-in-policies

    Mirza_Asad2723
    Mirza_Asad2723Author
    New Member
    January 21, 2025

    Dear Suraj,

     

    Thanks for your response and suggestion

    According to you, I noticed that UDP was disabled in the DNS protocol,

    Capture.JPG06.JPG

     

    so I enabled it.

    Capture.JPG07.JPG

     

    After that, 8.8.8.8 or 8.8.4.4 are no longer unreachable, but the latency is still varying between yellow and red, and the status hasn't turned green yet.

    Capture.JPG08.JPG

     

    Furthermore, can I enable TLS along with UDP since TLS is more secure?

    Or is there any other alternative option that could resolve the latency issue while also utilizing a security protocol?

     

    srajeswaran
    Staff
    srajeswaran
    Staff
    January 22, 2025

    Now the issue is with network latency, can you ping 8.8.4.4 and check the latency ?
    I am expecting similar latency, if thats the case its not a DNS issue but a network issue.

    Can you also try the default fortiguard DNS servers ? 96.45.45.45

    TLS and UDP DNS are 2 different settings and not working together.

      AEK
      SuperUser
      AEK
      SuperUser
      January 20, 2025

      Hi Mirza

      Do you have 2 IP addresses configured on your WAN interface?

      If so then you should configure the right source-ip under "config system dns" command.

      AEK
        Mirza_Asad2723
        Mirza_Asad2723Author
        New Member
        January 21, 2025

        Dear AEK,

         

        Yes, secondary IP addresses are also defined on the WAN interface, meaning I have defined one IP address from the static IP address pool provided by the ISP on the WAN interface, and the remaining IP addresses are defined as secondary addresses on the same WAN interface.

         

        I have checked, and there is no source IP defined in the 'config system dns'. Are you suggesting that I should define the IP address configured on the WAN interface as the source IP in 'config system dns'?

        AEK
        SuperUser
        AEK
        SuperUser
        January 21, 2025

        Hi Mirza

        Yes, try set the secondary IP as source IP under "config system dns".

        After that, try "exec ping example.com" and it should work.

        AEK
          Terms & ConditionsAccessibility statement