Explorer III

Solved

Fortigate to resolve local DNS entry for address object

Forum|Forum|2 years ago
November 19, 2023
5 replies
6913 views

Hello fellows!

In a FGT-61F I created a local DNS service for domain "local.tld" with some A records in it.
All clients using the fgt as their primary DNS server and can resolve all hosts in "local.tld" with their FQDN.

Fine.

Now I want to use this working FQDN resolution for some firewall policies, so I added some addresses.

When I try to use the same FQDN for an address object, fgt says "Unresolved FQDN: host.local.tld".

What am I doing wrong? Any suggestions?

Working on FGT-61F with FortiOS 7.2.6.

Any help welcome. Thank you in advance!

Regards, Michael.

FortiGate

Best answer by lgupta

Hello Mictronic,

Thanks for reaching out.

I think you are just seeing the GUI bug.

Please refer: https://docs.fortinet.com/document/fortigate/7.2.6/fortios-release-notes/236526/known-issues

Bug ID: 958311

Please run the following command:

diagnose test application dnsproxy 7

You will see the IPs being resolved.

Thank you!

AEK

SuperUser

Hello

FGT must to point to itself for DNS resolution.

Go to Network > DNS, and add FGT IP as primary DNS server.

AEK

MictronicAuthor

Explorer III

Hello AEK,

well, I ran into a GUI only bug, FQDN resolution for address objects works, even if I do not use internal DNS in Network DNS.

Regards, Mic

lguptaAnswer

Staff

Hello Mictronic,

Thanks for reaching out.

I think you are just seeing the GUI bug.

Please refer: https://docs.fortinet.com/document/fortigate/7.2.6/fortios-release-notes/236526/known-issues

Bug ID: 958311

Please run the following command:

diagnose test application dnsproxy 7

You will see the IPs being resolved.

Thank you!

MictronicAuthor

Explorer III

Hello Igupta,

yes that's it, FQDN resolution works but only the GUI says it's not.

Thanks for the hint to that bug.

Regards, Michael.

Ken_Durrant

New Member

So, If this only a GUI cosmetic bug, why do rules show no matched traffic or log these entries?

Seems more broken than just cosmetic. These logs are not getting to the SIEM, because they can't.

When will 7.2.8 firmware be released?

Sign up

Login with SSO

Login to the community

Login with SSO