Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
topcu
New Contributor II

DNS Split: resolve internal and external names local on the fortigate on different servers?

Hello all,

this request regards to DNS name resolution on the fortigate local only!

 

The configuration of the firewall was changed to per-VDOM dns, because FQDN objects in that vdom should be resolved by an external nameserver. But unfortunately this leads to problems with the resolution of configured firewall users. The fortigate needs to resolve names for the following purposes:

1. Names of local configured servers (LDAP, RADIUS, etc)

2. Names from configured FQDN policy objects

 

1. must be resolved from the internal nameserver

2. should be resolved from an external nameserver

 

Is there a way to fix this?

 

Version 6.2.2

 

Many thanks in advance. Regards, Hakan

2 REPLIES 2
pa_iva
New Contributor II

Hi,

 

You can define the primary dns server as your internal nameserver, define the local domain name, and use as secondary an external DNS server:

 

DNS settingsDNS settings

DNS resolution internal/externalDNS resolution internal/external

topcu
New Contributor II

Hi pa_iva, many thanks for your reply.

Yes, actually this works. I built this in a lab and did packet captures. The Fortigate is always asking both, the primary and secondary, regardless which domain is asked, and it will get an answer of one of both servers. But with this configuration I would loose the redundancy of the namservers. Means, if the primary fails, resolution of internal names would fail. Even if this works, I cannot implement this in our productive network.

 

Best regards, Hakan