Skip to main content
seadave
seadave
New Member
September 13, 2014
Question

Which DNS Settings to use?

  • September 13, 2014
  • 4 replies
  • 54937 views
I' m running 4.3P15. Currently I have my DNS settings to my two AD DCs. My logs are filled with DNS lookups from the Fortigate. Looking over the manual, I saw this: DNS server addresses are configured by going to System > Network > DNS. Here you specify the DNS server addresses. Typically, these addresses are supplied by your ISP. An additional option is available if you have local Microsoft domains on the network, by entering a domain name in the Local Domain Name field. So I changed the settings to my ISPs DNS address and entered my internal company.local domain for " Local Domain Name" . Now on the dashboard, the Fortinet does not resolve any of the names of internal IPs. How do you configure the Forinet so that for example, WAN1 traffic is resolved by ISP DNS and LAN1 is resolved by internal DNS?

    4 replies

    Dave_Hall
    Dave_Hall
    New Member
    September 13, 2014
    Not sure what would be the best practise in this case; my personal opinion would be to set up the Fortigate to use the internal DNS server IPs if you want it to resolve internal IP addresses, then set up the DNS services (on the AD DCs) to use your ISP' s DNS servers as " Forwarders" . If your WAN interface is configured via DHCP or PPPoE, you can force the fgt to use the DNS servers on that interface.
    netmin
    netmin
    New Member
    September 13, 2014
    Use cases are specific and DNS settings are a bit more limited on the FGT, but here another test example: - the corporate domain is: " example.local" - the corporate network is 192.168.17.0/24 - the FGT is configured with ISP DNS servers - local (DHCP) clients are configured to use the FGT interface IP as DNS - the FGT LAN interface is set to do recursive DNS lookup - a local DNS-database is used on the FGT with 2 non-authoritative master zones - the FGT shall be able to override the internal DNS server (forwards and backwards) - as is done for test.example.local - all other internal lookups shall be forwarded to the internal DNS server - the internal DNS server in this example is 192.168.17.224 - lookups not related to the corporate network shall be forwarded to the ISP DNS 
      config system dns-database      edit " corp_forward"           set authoritative disable              config dns-entry                  edit 1                      set hostname " test.example.local"                       set status enable                      set ttl 0                      set type A                      set ip 192.168.17.234                  next              end          set domain " example.local"           set forwarder " 192.168.17.224"           set source-ip 0.0.0.0          set status enable          set ttl 86400          set type master          set view shadow          unset allow-transfer          set contact " hostmaster"           set primary-name " dns"       next      edit " corp_reverse"           set authoritative disable              config dns-entry                  edit 1                      set hostname " test.example.local."                       set status enable                      set ttl 0                      set type PTR                      set ip 192.168.17.234                  next              end          set domain " 17.168.192.in-addr.arpa"           set forwarder " 192.168.17.224"           set source-ip 0.0.0.0          set status enable          set ttl 86400          set type master          set view shadow          unset allow-transfer          set contact " hostmaster"           set primary-name " dns"       next  end
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    September 14, 2014
    One hint as I' ve had this scenario lately: customer runs a DC (Srv 2012R2) customer wants to have the DNS not on the AD but on the FGT So I set up a local DNS base like posted above by netmin. All is working OK. Then...customer boots Win 8.1 PC. PC doesn' t find the DC. It turns out that the DNS needs to have a SRV record. FortiOS doesn' t support records other than A, CNAME, NS, MX, PTR. So we set up a DNS on the DC with only one record, namely a SRV record to itself. Forwarding is done to the FGT, which in turn forwards to the ISP' s DNS. Which is a hack. If anyone knows a smarter design I' d be grateful to get to know it.
    baitken
    baitken
    New Member
    September 15, 2014
    Active Directory requires functional DNS services in order to work properly, so all of your internal clients should use the DC as DNS server. If you don' t want your DC making DNS queries to the internet, you should configure the forwarder in the properties of the DNS server to be the FG. On the FG (5.2.0) ensure the DNS Database feature is enabled in System -> Config -> Features, then in System -> Network -> DNS Servers create a service for the internal interface.
    Ub3rus
    Ub3rus
    New Member
    November 22, 2016

    Is there a way to block the resolution of DNS records of some zones in local DNS Database for recursive DNS servers running on specific interfaces?

     

    For example, I have local zone on FortiGate which forwards lookups of internal corporate domain to internal DNS servers (As in your example.local example). I have wifi guests on isolated subnet using their local interface on fortigate as recursive DNS server. But I don't want them to be able to resolve internal corporate domain (security reasons). I want them to be able to resolve only some of the other zones I set up on the FortiGate and of course to resolve all public DNS records on the Internet.

    Terms & ConditionsAccessibility statement