Description
This article describes how to create a DNS database for a website that is hosted in the local network.
Scope
FortiGate.
Solution
Local DNS servers can be created for a network. Depending on the specific requirements, entries can either be manually managed (via a primary DNS server) or configured to reference an external source (as a secondary DNS server).
A local primary DNS server requires the manual addition of all URL and IP address combinations.
Configuration steps from the GUI:
- Go to System -> Feature Visibility and enable DNS Database under additional features.
- Navigate to Network -> DNS Servers and create a New DNS Database.
When configuring the DNS view, set it to 'Shadow' to ensure access is limited to internal users. Select the appropriate DNS zone and specify its domain name, along with the DNS server hostname and the administrator’s contact email address. Be sure to disable the Authoritative option, as IP addresses may change frequently and maintaining them manually can be time-consuming. Choosing the 'Shadow' type instead of 'Public' is essential for FortiGate to successfully perform nslookup on the internal database.
- Add DNS entries:
In the screenshot above, the FQDN is considered based on the mentioned hostname along with the domain name.
The DNS Entry also helps the FortiGate locally resolve FQDN (mywebsite3.com) to an IP address (192.168.100.10).
Verify the FQDN resolution by initiating pings on FortiGate.
exe ping mywebsite3.com
PING mywebsite3.com (192.168.100.10): 56 data bytes
64 bytes from 192.168.100.10: icmp_seq=0 ttl=64 time=0.6 ms
64 bytes from 192.168.100.10: icmp_seq=1 ttl=64 time=0.5 ms
64 bytes from 192.168.100.10: icmp_seq=2 ttl=64 time=0.5 ms
64 bytes from 192.168.100.10: icmp_seq=3 ttl=64 time=0.4 ms
64 bytes from 192.168.100.10: icmp_seq=4 ttl=64 time=0.4 ms
--- mywebsite3.com ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.4/0.4/0.6 ms
- Create a DNS Service on the interface:
In the above image, port1 is chosen as the device from where the IP address that needs to be resolved are located behind it.
- Set the DNS server as the default gateway of the firewall. In the above scenario, it is set as 172.16.32.1 (IP address of port1):
After the DNS server is mentioned, to test, perform an nslookup of the FQDN, which would resolve to the internal IP address hosted in the LAN network.
Related articles:
Technical Tip: DNS Database view type Shadow and Public for explicit proxy
Troubleshooting Tip: Internal DNS queries are not resolved when FortiGate is used as a DNS server
