What would be the benefit of the DNS database set as slave? Thanks in advance.
Jerry Paul White
Network Engineer/Tech Supervisor
" 01001000 01100001 01110110 01100101 00100000 01100001 00100000 01000111 01101111 01101111 01100100 00100000 01000100 01100001 01111001"
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
1- if used as a gateway firewall, the FGT should be the only DNS used on all protected LANs, as Best Practise. It uses a trusted external DNS, the ISP's. But, as a drawback, it will not resolve local names.
Usually, the local DNS database is kept on a Windows server (as it supports dynamic DNS, which the FGT does not). Mirroring the server's DNS to the FGT allows to use the FGT as the authoritative DNS of it's LANs.
2- the FGT will cache DNS requests, vastly accelerating DNS requests. It will do so in any DNS configuation, including being used as DNS slave, but this aspect makes using the FGT as DNS even more attractive.
sure, aggree. What I've outlined refers to setups with one (border) firewall only. The point I was trying to make is that an external DNS needs to be trusted, and that the FGT knows one. I usually block all DNS from internal to internet as the hosts should use the (Windows server) internal DNS which in turn uses the FGT as external DNS.
No clear answer here, but I'll start with an observation - having seen few hundreds of Fortigates so far in my career, I am yet to recall a single one with the Slave DNS zone configured.
Now as an exercise in logic, Slave zones are mostly used to lower load on the authoritative DNS server | decrease latency in DNS queries for clients | protect authoritative DNS from bad/malicious clients. With none of it fitting easily with Fortigate DNS serving query requests from internal networks (if your internal hosts are attacking AD DC, you've got bigger problems than DNS).
Moreover, Windows LAN environment - using FGT instead of AD DC is possible, but FGT does not support SRV records, which are crucial for Windows environment.
In summary - I don't see any business need for this feature, nor ever tried one.
1- if used as a gateway firewall, the FGT should be the only DNS used on all protected LANs, as Best Practise. It uses a trusted external DNS, the ISP's. But, as a drawback, it will not resolve local names.
Usually, the local DNS database is kept on a Windows server (as it supports dynamic DNS, which the FGT does not). Mirroring the server's DNS to the FGT allows to use the FGT as the authoritative DNS of it's LANs.
2- the FGT will cache DNS requests, vastly accelerating DNS requests. It will do so in any DNS configuation, including being used as DNS slave, but this aspect makes using the FGT as DNS even more attractive.
But DNS should be on dns-servers and not a firewall imho and more so if you have internal and external edge firewalls. A proper design server hosted dns with split-views out weighs anything that the fortigate can do.
Ken Felix
PCNSE
NSE
StrongSwan
sure, aggree. What I've outlined refers to setups with one (border) firewall only. The point I was trying to make is that an external DNS needs to be trusted, and that the FGT knows one. I usually block all DNS from internal to internet as the hosts should use the (Windows server) internal DNS which in turn uses the FGT as external DNS.
No clear answer here, but I'll start with an observation - having seen few hundreds of Fortigates so far in my career, I am yet to recall a single one with the Slave DNS zone configured.
Now as an exercise in logic, Slave zones are mostly used to lower load on the authoritative DNS server | decrease latency in DNS queries for clients | protect authoritative DNS from bad/malicious clients. With none of it fitting easily with Fortigate DNS serving query requests from internal networks (if your internal hosts are attacking AD DC, you've got bigger problems than DNS).
Moreover, Windows LAN environment - using FGT instead of AD DC is possible, but FGT does not support SRV records, which are crucial for Windows environment.
In summary - I don't see any business need for this feature, nor ever tried one.
Thanks for all the info. This might sound weird but what a great community.
Jerry Paul White
Network Engineer/Tech Supervisor
" 01001000 01100001 01110110 01100101 00100000 01100001 00100000 01000111 01101111 01101111 01100100 00100000 01000100 01100001 01111001"
Personal choice, mostly. Both versions will work just fine.
You can only forward to their services if you are okay with Cloudflare/Google DNS/OpenDNS knowing every domain you visit and potentially doing bad stuff with that knowledge. In general, they are quicker than querying the root servers directly. Querying root servers enables you to bypass a single entity that has all your queries (except your ISP), however traffic can not be encrypted, whereas DNS over TLS is already provided by Cloudflare (probably Google too).
DNSSEC is useless since it does not have encryption, it just verifies the response of the server.
My Life My Style
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1547 | |
1031 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.