Technical Tip: Improve FQDN re-query interval on FortiGate

[aishaqui]

Description	This article describes how to improve the FQDN re-query interval on FortiGate. When the DNS server sends back round-robin or GSLB-based replies, then the FortiGate FQDN address object and the client requesting the DNS resolution can have different IPs because the GSLB resolution changes every few seconds (could be 4 or 5 seconds) and thus the traffic is blocked. Take the example of FQDN cfengine-package-repos.s3.amazonaws.com. nslookup to cfengine-package-repos.s3.amazonaws.com gives the below result. Non-authoritative answer: Name:    s3-w.us-east-1.amazonaws.com Address:  52.216.102.115 Aliases:  cfengine-package-repos.s3.amazonaws.com           s3-1-w.amazonaws.com If Wireshark is run on the client machine and the DNS reply for s3-1-w.amazonaws.com is checked, the ttl would be 5 seconds or less. Before 7.2.1, there was hard-coded minimal FQDN re-query interval of 60 seconds. But starting from 7.2.1, this hard-coded timer can now be modified so that FortiGate can re-query the FQDN more frequently.
Scope	FortiOS 7.2.1 +
Solution	The 'fqdn-min-refresh' interval can be set between 10 sec and 3600 sec. config system dns     set fqdn-min-refresh 10 end The minimum refresh is the lowest allowed refresh time. i.e. the FQDN cache cannot refresh at an interval shorter than this value. Using this setting, FQDNs that require fast resolutions can refresh at a faster rate without impacting other FQDNs that have longer TTL records. Starting from FortiOS version 7.4, a new setting has been introduced to manage the upper limit of the FQDN refresh timer. The `fqdn-max-refresh` setting is employed to govern the global upper limit of the FQDN refresh timer. For FQDN entries with a time to live (TTL) exceeding the maximum refresh value, their refresh timer will be adjusted to this upper limit. This feature empowers FortiGate to set the maximum limit for querying DNS updates for its FQDN addresses. By default, the fqdn-max-refresh time is 3600 seconds, and the configurable range is 3600 to 86400 seconds. config system dns     set fqdn-max-refresh <integer value> end