Currently, we are using the 1200D firewall in our corporate office. In the Box, we have created multiple ADOMs and multiple ISP links as well. Hover, we are facing the issues in DNS lookup field error in the sum of the websites. And we have already configured Global VDOMs in global DNS like 22.214.171.124 and 126.96.36.199.
But, when we are facing the issue of a DNS lookup failed error, we have to change the DNS IP as per the ISP providing the own DNS IPs.
Could you tel me any option available in FortiGate to configure the multiple DNS IPs? If the option it's available please
You have two cases. either the hosts on the VDOMs are using the FortiGate as the DNS or they have a DNS configuration distributed by DHCP or manually. If FortiGate is the DNS, it will use the DNS configured on it and FortiGate will try to reach it according to the routing on the device. So, check the routing on FortiGate and specify the DNS for the ISP it goes through to resolve the DNS. If each VDOM has its own DNS, configure it as the link it goes through.
let's differentiate between two points; DNS lookup and the traffic. The traffic will be according to the security policy, and this may include the DNS lookup.
The DNS lookup is according to the DNS configured on the hosts. If you use a DHCP server, you have the control to distribute different DNS to each subnet. For example on FortiGate
config system dhcp server edit 3 set default-gateway 10.1.6.8 set netmask 255.255.255.0 set interface "Workstation" config ip-range edit 1 set start-ip 10.1.6.220 set end-ip 10.1.6.240 next end set dns-server1 10.1.2.23 set dns-server2 10.1.2.24 next end
In the DHCP server configuration, you have three options for the DNS
FortiGate # set dns-service local: IP address of the interface the DHCP server is added to becomes the client's DNS server IP address. default: Clients are assigned the FortiGate's configured DNS servers. specify: Specify up to 3 DNS servers in the DHCP server configuration.
If you decide that the hosts will use the FortiGate interface, then you should confirm that the default gateway or the route to the DNS on FortiGate goes through the ISP that will allow it.
The same If you decide that the hosts will use the default DNS of FortiGate, then you should confirm that the routing of this traffic from the users is allowed and goes through the ISP that will allow it.
If you specify, then specify for each subnet the suitable DNS.
To conclude, if FortiGate is the DNS, then it is a matter of how FortiGate resolves DNS. If the hosts uses a DNS, then they should use the correct one.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.