Technical Tip: FortiGate DNS visibility FQDN kernel update.

[aabukhshim]

Description	This article explains FortiGate's ability to inspect and update the kernel with passing DNS queries’ responses for local FQDN address objects.
Scope	FortiOS.
Solution	Background:  The following diagram is used to explain this behavior.  The FQDN and related IPs are used only to explain this behavior.    FortiGate is configured to use external public DNS. fortinet.com.evelab.com is added to FortiGate as an FQDN address object.  The Local DNS server has a static DNS entry map for fortinet.com.evelab.com the corresponding IP is 10.10.10.10. The Internal PC uses the local DNS server. The Internal PC will send all DNS queries to the local DNS server. Observations and notes:   FortiGate queries the External DNS server to resolve the FQFN  fortinet.com.evelab.com and add the IP to the list. The IP is 89.31.143.1.   firewall fqdn list-ip  List all IP FQDN:  fqdn_u 0x105b0b86 fortinet.com.evelab.com: type:(1) ID(54) count(1) generation(16) data_len:13 flag: 1  ip list: (1 ip in total)  ip: 89.31.143.1  <- Total ip fqdn range blocks: 1.  Total ip fqdn addresses: 1.      Then, once the Internal PC queries the Local DNS server for fortinet.com.evelab.com, it gets the IP address 10.10.10.10. And since this traffic is routed via FortiGate, the DNS response is added to the FQDN address list, as shown below:   firewall fqdn list-ip  fqdn_u 0x105b8d96 fortinet.com.evelab.com: type:(1) ID(54) count(2) generation(17) data_len:26 flag: 1  ip list: (1 ip in total)  ip: 89.31.143.1  <- ip list: (1 ip in total)  ip: 10.10.10.10  <- Total ip fqdn range blocks: 2.  Total ip fqdn addresses: 2.   The above behavior might not be desired in some implementations.   Solution:  There are two workarounds to change this behavior as shown below:  Disable Network visibility (this feature is not available on versions 6.4 and above). config system network-visibility      set destination-visibility disable  Remove DNS session helper entry: config system session-helper      delete 14  end   Note: The dnsproxy service must be restarted after making the above changes, and if FortiGate units are deployed in a HA cluster, the dnsproxy service must be restarted in all HA members at about the same time to prevent one of the secondary updating the primary FQDN list with the undesired IP. Without restarting the dnsproxy the undesired entry will stay until DNS TTL expires.   diagnose test application dnsproxy 99