| Description | This article describes what to look for when FQDN fails to resolve an IP if the DNS profile is enabled in the DNS Server configuration. |
| Scope | FortiGate, DNS. |
| Solution |
When trying to do nslookup on FQDN that exists in DNS Server DB, the request timed out.
The issue was identified to be related to SDNS reachability by running a dnsproxy debug:
diagnose debug application dnsproxy -1 diagnose debug enable
Check upstream if this IP address (173.243.140.53; used for DNS rating) is blocked. It is possible to use the following command to check the SDNS connection status of all servers:
diagnose debug rating
For more details on how to interpret the results of this command, refer to the following article: As a workaround, it is possible to disable the DNS profile in the DNS Server configuration.
It can resolve FQDN to an IP address post changes.
|
