fortiview website monitor is not resolving the IPS into the domain names- FORTIWIFI 40F

Forum|Forum|1 year ago
November 20, 2024
8 replies
2289 views

Hi,

for some strange reason:

1) the fortiview website monitor is not resolving the IPs into the relative domain name

2) I am only able to view for "now" all other options don't work ( 1hr, 24 hrs, etc..)

looking around I have created my local DNS servers in thinking that I needed a reverse lookup?

therefore I created 2 local DNS using 8.8.8.8 and 8.8.4.4 with " A" records and I created also 2 "PTR" records off of each IP. therefore I have 4 records.

question 1: is it correct to use google IPs for my local DNS?

question 2: is it correct to use the relative "PTR" records?

question 3: seems none of this is working to get me the domain names in the fortiview website monitor therefore something is wrong.

thank you

FortiGate

AEK

SuperUser

Hello Antonio

As far as I know, FG doesn't show the domain names unless it sees the DNS resolution that was done by the client for that site.

So in case you client is using DNS over HTTPS or over SSL and the FG doesn't use deep inspection for the related DNS policy, then FG doesn't see which domain name is requested by the client.

Reverse lookup will not help. And I think using 8.8.8.8 & 8.8.4.4 as local addresses is not a clean solution.

You may try one of the following and it should work.

Force user to do DNS resolution from FG (and deny DNS requests from clients to any other destination)
Or force them to do DNS resolution from other local DNS server via legacy unencrypted method
Or enable deep inspection to read encrypted DNS queries and responses (I didn't try it but it should work as well)

Hope it helps.

AEK

antoniocerasuoloAuthor

Explorer

hi AEK,

can you please outline the steps to undertake in each one of those bullet points?? because as is it's not very clear how to put into concrete action what you sugget.

ciao,
Antonio

AEK

SuperUser

Let's implement the second example:

Setup your local DNS server
Configure all your client to do DNS resolution from your local DNS server (e.g.: set it via DHCP)
On your FG, create a firewall rule to allow DNS traffic from clients to local DNS server
On your FG, deny any other encrypted DNS traffic from clients to anywhere. You can do this with application profile, under Application and Filter Override, then block DNS.Over.HTTPS and DNS.Over.TLS

AEK

antoniocerasuoloAuthor

Explorer

hi AEK,

thank you!!!!

in truth I have started toi actually look at the logs on the forticloud and I have purchased the fortianalyzer cloud license as well so waiting to implement that sometime nexrt week!

that being said of the points above , points 1 & 2 are clear! points 3 & 4 are not clear how to atually do that on a step by step basis?

don't want to bug you, if you can outline those I would appreciate it, but understand if you don't have the time!

ciao,
Antonio

AEK

SuperUser

Hi Antonio

3. On your FG, create a firewall rule to allow DNS traffic from clients to local DNS server

On FG, go to Policy & Object > Firewall Policy, add a new policy with the below values:
- Src intf: Client interface (or VLAN)
- Dst intf: DNS server interface (or VLAN)
- Src: Client IP range
- Dst: DNS server IP
- Service: DNS
- Action: Accept

4. On your FG, deny any other encrypted DNS traffic from clients to anywhere. You can do this with application profile, under Application and Filter Override, then block DNS.Over.HTTPS and DNS.Over.TLS

On FG, go to Security Profiles > Application Control, and edit the app profile that you are using for your clients' traffic towards internet, as follows:
- Under section "Application and Filter Overrides", click Create New
- Select application "DNS.Over.HTTPS", and action "Block", then validate
- Click again Create New, then do the same with "DNS.Over.TLS" app
As mentioned, this assumes the above app profile is used in firewall policy(ies) that is filtering clients' traffic to internet. But in case you are not using an application profile in the policy

Hope it helps.

AEK