Skip to main content
luca1994
luca1994
Explorer III
October 5, 2023
Solved

FQDN resolved with ip 208.91.112.55

  • October 5, 2023
  • 3 replies
  • 14234 views

Hello Team,

 

when the client tries to reach a specific url "http://fqdn:9999", in the log I see that the FQDN is resolved with the ip 208.91.112.55 (fortinet block page).

If I try to ping the FQDN from the fortigate cli, the ip that is resolved is correct but from the client it is 208.91.112.55.

 

Any suggestion?

 

Thanks for the support

Best answer by omega332

Had a customer once experience issues like this and it ended up being his dns server. It was failing to resolve hostnames so it would redirect to the dns block page. Then his dns server was caching the address and causing all sorts of issues.

3 replies

esalija
Staff
esalija
Staff
October 5, 2023

Hi,

Please run the below commands to check where the traffic is going and which is the policy that match.

# diagnose sniffer packet any "host x.x.x.x and host y.y.y.y" 4 0 l

 

***  x.x.x.x  is the Source IP address and y.y.y.y is the destination IP ***

 

ctrl+C to stop

 

Putty 2

-------

# diag debug reset

# diagnose debug flow filter addr x.x.x.x -->Source IP address

# diagnose debug flow filter addr y.y.y.y -->Destination IP address

# diag debug console timestamp enable

# diag debug flow trace start 9999

# diag debug enable

 

***  x.x.x.x  is the Source IP address and y.y.y.y is the destination IP ***

 

*** Run for 5-10 minutes ***

 

# diagnose debug disable

# diag debug reset

Best regards,

Erlin

luca1994
luca1994Author
Explorer III
October 5, 2023

The policy that match is the correct policy.

 

Thanks

hbac
Staff
hbac
Staff
October 5, 2023

Hi @luca1994,

 

You have a DNS filter enabled and that website is being blocked by DNS filter. You can exempt it by using domain filter: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Static-DNS-filter-to-allow-block-DNS-queries/ta-p/192151

 

Regards, 

luca1994
luca1994Author
Explorer III
October 6, 2023

Hello @hbac,

 

Thank you for the feedback. In the policy the DNS filtering is not enabled. In the log section I see that it is the application control that blocksapplication control.png

 

Thansk for the support

 

BR

 

omega332
omega332Answer
New Member
October 6, 2023

Had a customer once experience issues like this and it ended up being his dns server. It was failing to resolve hostnames so it would redirect to the dns block page. Then his dns server was caching the address and causing all sorts of issues.

luca1994
luca1994Author
Explorer III
October 6, 2023

Hi @omega332 ,

 

In this case the DNS server of the client is a Windows Server DNS, so in your opinion the problem is the cache of this DNS?

 

Thanks

 

BR

Terms & ConditionsAccessibility statement