Skip to main content
shawn
shawn
New Member
January 16, 2020
Question

Split DNS for local domain resolution: working in CLI, not on Command Prompt

  • January 16, 2020
  • 1 reply
  • 4173 views

I'm a newbie, so apologies if this seems like a simple question... I'm working on a FortiGate 60E running firmware 6.0.4.

 

I'm trying to setup Split DNS for resolution of local VMs. I've followed the instructions (Master, Shadow, Non-Authoritative, etc.) and added the WAN to the "DNS Service on Interface". I've also added the local domain to the interface (ietech.local). I've set the WAN to Recursive... Unfortunately, I'm not able to get the Windows command prompt to return anything but the fortinet  servers. However, when I execute a ping on the FortiGate CLI, it properly resolves the addresses / hosts... I'm guessing this is something simple that I'm overlooking... Any ideas?

 

I appreciate any help / thoughts available as I've been struggling with this for a while now...

 

Cheers,

Shawn

 

    1 reply

    Dave_Hall
    Dave_Hall
    New Member
    January 17, 2020

    I think you want to set up a DNS server (database) on the internal LAN side rather than on the WAN interface.  Then you need to make sure the IP address for the interface (that has the DNS service tied to) is handed out to clients via DHCP. 

    shawn
    shawnAuthor
    New Member
    January 18, 2020

    Thank you Dave for your support in this!!

     

    I have been able to configure the fortigate with the DNS server on the internal LAN!! I then set the system to use the IP address of the fortigate on the DHCP as you suggest. It works great and am very happy with the performance :)

     

    As a note, I also found that this did not work with the ietech.local domain. Although I don't know the details, the ".local" seems to be reserved with special rules around it... Here is a copy of the script I ended up using in case anyone else finds this thread and is looking for a solution:

     

    Thanks again!

    Shawn

    --== CLI SCRIPT ==--

     

    config system dns-database   edit "corp_forward"     set authoritative disable       config dns-entry         edit 1           set hostname "ledger.ietech.ca"           set status enable           set ttl 0           set type A           set ip 192.168.1.118         next       end     set domain "ietech.ca"     set forwarder "192.168.1.99"     set source-ip 0.0.0.0     set status enable     set ttl 86400     set type master     set view shadow     unset allow-transfer     set contact "hostmaster"     set primary-name "dns"   next   edit "corp_reverse"     set authoritative disable       config dns-entry         edit 1           set hostname "ledger.ietech.ca."           set status enable           set ttl 0           set type PTR           set ip 192.168.1.118         next       end     set domain "1.168.192.in-addr.arpa"     set forwarder "192.168.1.99"     set source-ip 0.0.0.0     set status enable     set ttl 86400     set type master     set view shadow     unset allow-transfer     set contact "hostmaster"     set primary-name "dns"   next end

     

    Terms & ConditionsAccessibility statement