FQDN lookups

the handbooks explains it quite well i believe

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/560763/fqdn-addresses

The FortiGate firewall keeps track of the DNS TTLs so as the entries change on the DNS servers the IP address will effectively be updated for the FortiGate. As long as the FQDN address is used in a security policy, it stores the address in the DNS cache.

DarrellH wrote:

Hi - I'm new to the forum, so apologies if i have posted in the wrong place.  I did search for the answer to this, but couldn't find anything.

 

I have a FortiGate 200E and a policy that allows outbound traffic to a FQDN.  My question is..

When a FQDN is used, does the Fortigate look it up every time, or just cache the IP it finds and then leave it there?  So, if a FQDN is name.domain.com, with IPs 1.2.3.4 and 4.3.2.1 will it look up just the 1st and cache it, and never allow traffic to 4.3.2.1 (if 1.2.3.4 is not available)?

 

I hope that was clear.

There is TTL associated with FQDN in the DNS CACHE, to check current cache remaining ttl run from cli:

dia test app dnsproxy 7

You can also view current resovled fqdn list from cli:

dia firewall fqdn list