WiFi VLAN Clients on DMZ can't resolve DNS inquires to local LAN

Forum|Forum|3 years ago
September 16, 2022
1 reply
1212 views

Hello,

Currently have Merkai AP's that route clients on VLAN1001 to the Gate. Subnet is 172.16.2.X. This interface sits in a DMZ, so I made a policy: From>DMZ, To>Inside, Source>VLAN1001, Destination> VLANx(Internal Servers), Service>ALL, NAT>Enabled

I am able to ping and RDP via IP (10.100.1.X) to said VLANx that hosts our servers so I know that it is working, but when trying to resolve host names or RDP via hosts, the DNS queries fail. The DNS server is hosted on the VLANx, where I have my policy pointing to. I have made VLAN1001 Recursive in the DNS Service on the gate itself, as well as pointing the VLAN1001 interface directly to the DNS server instead of choosing same as sys/inter options.

Could anyone give me a pointer to possible help walk me through the small step that I am missing?

Thank you all so much ahead of time for you assistance and patience

FortiGate

A

Anonymous_User

New Contributor III

Hello @l0gan,

Thanks for reaching Fortinet Community. Could you confirm the following?

- The policy in the firewall that allows the traffic to DNS server, does it allow all services apart from ICMP and RDP. Meaning does the policy allow DNS traffic?

- If yes, can you see if that policy records the logs and if you can verify any traffic is being blocked by the firewall?

Hope to hear back from you soon.

Thanks and regards,

l0ganAuthor

New Member

Hello Aashiq, thank you for your reply!

I have gone ahead and confirmed the following:

The firewall policy does allow ALL services (double checked the policy). I just noticed that in the policy, NAT was unchecked. I went fixed that policy, enabled what I needed and my wifi subnet is now resolving the inquires!

Apologies for taking up your time but I appreciate your response and helping me.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded