How to configure a LAN interface with DHCP disabled to use the ISP DNS server?

Question

I have a Fortigate with a LAN interface with a static IP address (no DHCP enabled) which provides internet services to my internal network. The LAN interface is set up as a "DNS Service on Interface" which forwards any host DNS queries to the system DNS. Therefore my host has been configured with the LAN interface IP address as the preferred DNS server address. However, in the Fortigate DNS page I cannot specify that I want to use system DNS and I am given just two options: Use FortiGuard Servers or Specify (which requires me to write down static IP addresses). I am using Fortiguard servers (i.e. primary and secondary DNS servers) but my WAN interface (which has both DHCP and Override internal DNS enabled) uses my ISP DNS server (i.e. Acquired DNS).

I want my LAN interface to use my ISP DNS server and acquire its address automatically as my WAN interface already does, but I am not sure what DNS server is being used to resolve my host DNS queries as the Fortigate has the Fortiguard servers configured as DNS servers but the wan interface is using the ISP DNS server. How may I know which DNS server is resolving my host DNS queries? If the Fortiguard servers are the ones making the resolution, how may I configure the LAN interface to use my ISP DNS server instead without having to enable DHCP?

Toshi_Esumi · Accepted Answer

Probably you need to use "diag test application dnsproxy 3" to see what DNS server IPs the daemon has.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-Troubleshooting-DNS-commands/ta-p/192617

Then I enabled override on Lumen circuit and then Comcast circuit next. The result was below. So the last one you enabled would come to the top. It seems.
fg40f-utm (global) # diag test application dnsproxy 3
worker idx: 0
VDOM: root, index=0, is primary, vdom dns is enabled, pip-0.0.0.0 dns_log=1
dns64 is disabled
DNS servers:
75.75.75.75:53 vrf=0 tz=0 encrypt=none req=0 to=0 res=0 rt=0 ready=1 timer=0 probe=0 failure=0 last_failed=0
75.75.76.76:53 vrf=0 tz=0 encrypt=none req=0 to=0 res=0 rt=0 ready=1 timer=0 probe=0 failure=0 last_failed=0
205.171.3.65:53 vrf=0 tz=0 encrypt=none req=0 to=0 res=0 rt=0 ready=1 timer=0 probe=0 failure=0 last_failed=0
205.171.2.65:53 vrf=0 tz=0 encrypt=none req=0 to=0 res=0 rt=0 ready=1 timer=0 probe=0 failure=0 last_failed=0
96.45.45.45:853 vrf=0 tz=0 encrypt=dot req=15 to=0 res=15 rt=2 ready=1 timer=0 probe=0 failure=0 last_failed=0
96.45.46.46:853 vrf=0 tz=0 encrypt=dot req=10 to=0 res=10 rt=2 ready=1 timer=0 probe=0 failure=0 last_failed=0
<snip>

To see actual DNS each query caused the FGT to asked to, you probably have to sniff UDP 53 traffic with like "diag sniffer packet any 'udp and port 53' 4 0"

Toshi

jintrah_FTNT · Answer

Hi,   When you have Override internal DNS enabled on WAN interface, the dns servers received from ISP would be used and preferred over the one's defined for use in  Fortigate DNS page.   Best regards, Jin

Sign up

Login with SSO

Login to the community

Login with SSO