Add Multiple DNS IP in Fortigate Fw

[Ranjith1]

Dear Team,

Currently, we are using the 1200D firewall in our corporate office.  In the Box, we have created multiple ADOMs and multiple ISP links as well. Hover, we are facing the issues in DNS lookup field error in the sum of the websites. And we have already configured Global VDOMs in global DNS like 8.8.8.8 and 4.2.2.2. 

But, when we are facing the issue of a DNS lookup failed error, we have to change the DNS IP as per the ISP providing the own DNS IPs. 

Could you tel me any option available in FortiGate to configure the multiple DNS IPs?  If the option it's available please

[sagha]

Hi Ranjith, 

This article might help: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuration-per-VDOM-DNS/ta-p/190815

Thank you. 

Shahan

[Mohamed_Gaber]

You have two cases. either the hosts on the VDOMs are using the FortiGate as the DNS or they have a DNS configuration distributed by DHCP or manually. If FortiGate is the DNS, it will use the DNS configured on it and FortiGate will try to reach it according to the routing on the device. So, check the routing on FortiGate and specify the DNS for the ISP it goes through to resolve the DNS. If each VDOM has its own DNS, configure it as the link it goes through.

[Ranjith1]

Thanks For a replay,

can you share the configuration files it will help for me.  

[Mohamed_Gaber]

config system dns
set primary 10.2.2.23
set secondary 10.2.2.24
end

[Mohamed_Gaber]

let's differentiate between two points; DNS lookup and the traffic. The traffic will be according to the security policy, and this may include the DNS lookup.

The DNS lookup is according to the DNS configured on the hosts. If you use a DHCP server, you have the control to distribute different DNS to each subnet. For example on FortiGate

config system dhcp server
edit 3
set default-gateway 10.1.6.8
set netmask 255.255.255.0
set interface "Workstation"
config ip-range
edit 1
set start-ip 10.1.6.220
set end-ip 10.1.6.240
next
end
set dns-server1 10.1.2.23
set dns-server2 10.1.2.24
next
end

In the DHCP server configuration, you have three options for the DNS

FortiGate # set dns-service
local: IP address of the interface the DHCP server is added to becomes the client's DNS server IP address.
default: Clients are assigned the FortiGate's configured DNS servers.
specify: Specify up to 3 DNS servers in the DHCP server configuration.

If you decide that the hosts will use the FortiGate interface, then you should confirm that the default gateway or the route to the DNS on FortiGate goes through the ISP that will allow it.

The same If you decide that the hosts will use the default DNS of FortiGate, then you should confirm that the routing of this traffic from the users is allowed and goes through the ISP that will allow it.

If you specify, then specify for each subnet the suitable DNS.

To conclude, if FortiGate is the DNS, then it is a matter of how FortiGate resolves DNS. If the hosts uses a DNS, then they should use the correct one.