Dear Team,
Currently, we are using the 1200D firewall in our corporate office. In the Box, we have created multiple ADOMs and multiple ISP links as well. Hover, we are facing the issues in DNS lookup field error in the sum of the websites. And we have already configured Global VDOMs in global DNS like 8.8.8.8 and 4.2.2.2.
But, when we are facing the issue of a DNS lookup failed error, we have to change the DNS IP as per the ISP providing the own DNS IPs.
Could you tel me any option available in FortiGate to configure the multiple DNS IPs? If the option it's available please
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi Ranjith,
This article might help: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuration-per-VDOM-DNS/ta-p/190815
Thank you.
Shahan
You have two cases. either the hosts on the VDOMs are using the FortiGate as the DNS or they have a DNS configuration distributed by DHCP or manually. If FortiGate is the DNS, it will use the DNS configured on it and FortiGate will try to reach it according to the routing on the device. So, check the routing on FortiGate and specify the DNS for the ISP it goes through to resolve the DNS. If each VDOM has its own DNS, configure it as the link it goes through.
Thanks For a replay,
can you share the configuration files it will help for me.
config system dns
set primary 10.2.2.23
set secondary 10.2.2.24
end
let's differentiate between two points; DNS lookup and the traffic. The traffic will be according to the security policy, and this may include the DNS lookup.
The DNS lookup is according to the DNS configured on the hosts. If you use a DHCP server, you have the control to distribute different DNS to each subnet. For example on FortiGate
config system dhcp server
edit 3
set default-gateway 10.1.6.8
set netmask 255.255.255.0
set interface "Workstation"
config ip-range
edit 1
set start-ip 10.1.6.220
set end-ip 10.1.6.240
next
end
set dns-server1 10.1.2.23
set dns-server2 10.1.2.24
next
end
In the DHCP server configuration, you have three options for the DNS
FortiGate # set dns-service
local: IP address of the interface the DHCP server is added to becomes the client's DNS server IP address.
default: Clients are assigned the FortiGate's configured DNS servers.
specify: Specify up to 3 DNS servers in the DHCP server configuration.
If you decide that the hosts will use the FortiGate interface, then you should confirm that the default gateway or the route to the DNS on FortiGate goes through the ISP that will allow it.
The same If you decide that the hosts will use the default DNS of FortiGate, then you should confirm that the routing of this traffic from the users is allowed and goes through the ISP that will allow it.
If you specify, then specify for each subnet the suitable DNS.
To conclude, if FortiGate is the DNS, then it is a matter of how FortiGate resolves DNS. If the hosts uses a DNS, then they should use the correct one.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.