Queried FQDN ip becomes 208.91.112.55

[JanuBari]

Hi,

When we do nslookup we always get answer where the fqdn's ip address is changed to 208.91.112.55:
Could it be DNS filtering is messing with the dns response where a rule/policy matched the query?

Thanks!

[TxAggieEngineer]

That is the IP address of the FortiGuard "Redirect Portal" used by DNS filtering.  If the FQDN is in a blocked category, the ForitiGate will rewrite the DNS response to this IP address.

[JanuBari]

If DNS filtering profile is not applied to a policy this will not be used right?

[TxAggieEngineer]

Correct.  The profile would need to be applied to a policy.  Otherwise, the FortiGate will pass DNS requests through unaltered.  The only other way DNS would be altered would be a static translation but it seems highly unlikely there would be a static translation to FortiGuard's redirect portal.-------------------------------------------
Original Message:
Sent: Sep 06, 2020 10:23 PM
From: Janus Barinan
Subject: Queried FQDN ip becomes 208.91.112.55

If DNS filtering profile is not applied to a policy this will not be used right?
Original Message:
Sent: Sep 06, 2020 05:54 AM
From: Mark Bell
Subject: Queried FQDN ip becomes 208.91.112.55

That is the IP address of the FortiGuard "Redirect Portal" used by DNS filtering.  If the FQDN is in a blocked category, the ForitiGate will rewrite the DNS response to this IP address.
Original Message:
Sent: Sep 06, 2020 02:18 AM
From: Janus Barinan
Subject: Queried FQDN ip becomes 208.91.112.55

Hi,

When we do nslookup we always get answer where the fqdn's ip address is changed to 208.91.112.55:
Could it be DNS filtering is messing with the dns response where a rule/policy matched the query?

Thanks!

[JanuBari]

I see. Can you tell me more about static translation where it is applied? How to check it?

[TxAggieEngineer]

From the CLI, go to "config firewall dnstranslation" and do "show".  Starting in (I believe) 6.2, static DNS translations can also be configured from the GUI under the DNS Filter security profile.

[JanuBari]

Could expired license would cause dns translation to redirect portal 208.91.112.55?

[TxAggieEngineer]

I know expired services can end up blocking web access, although it's inconsistent in my experience.  I'm not sure what effect expired services would have on traffic with a DNS Security Profile configured.

[mrodriguezlucendo]

Good morning

I am having the same problem as the colleague, I do not have any DNS profile enabled and randomly the FW that has DNS, the internal dns, the fqdn resolve to 208.91.112.55 (without having any profile set in the fw) causing interruptions in the navigation The pc consults some internal dns (windows) and they have a forwarder to google passing the traffic through the fortinet, the traffic from the internal dns to the internet has no UTM or certificate policy. Can you think of something?

[luca1994]

Good morining,

were you able to solve the problem?

Thanks in advance for the feedback