Benefit of DNS database!!!

[JerryPWhite1]

What would be the benefit of the DNS database set as slave? Thanks in advance.

[ede_pfau · Accepted solution]

1- if used as a gateway firewall, the FGT should be the only DNS used on all protected LANs, as Best Practise. It uses a trusted external DNS, the ISP's. But, as a drawback, it will not resolve local names.

Usually, the local DNS database is kept on a Windows server (as it supports dynamic DNS, which the FGT does not). Mirroring the server's DNS to the FGT allows to use the FGT as the authoritative DNS of it's LANs.

2- the FGT will cache DNS requests, vastly accelerating DNS requests. It will do so in any DNS configuation, including being used as DNS slave, but this aspect makes using the FGT as DNS even more attractive.

[ede_pfau · Accepted solution]

sure, aggree. What I've outlined refers to setups with one (border) firewall only. The point I was trying to make is that an external DNS needs to be trusted, and that the FGT knows one. I usually block all DNS from internal to internet as the hosts should use the (Windows server) internal DNS which in turn uses the FGT as external DNS.

[ede_pfau · Accepted solution]

1- if used as a gateway firewall, the FGT should be the only DNS used on all protected LANs, as Best Practise. It uses a trusted external DNS, the ISP's. But, as a drawback, it will not resolve local names.

Usually, the local DNS database is kept on a Windows server (as it supports dynamic DNS, which the FGT does not). Mirroring the server's DNS to the FGT allows to use the FGT as the authoritative DNS of it's LANs.

2- the FGT will cache DNS requests, vastly accelerating DNS requests. It will do so in any DNS configuation, including being used as DNS slave, but this aspect makes using the FGT as DNS even more attractive.

[emnoc]

But DNS should be on dns-servers and not a firewall imho and more so if you have internal and external edge firewalls. A proper design server hosted dns with split-views out weighs anything that the fortigate can do.

Ken Felix

[ede_pfau · Accepted solution]

sure, aggree. What I've outlined refers to setups with one (border) firewall only. The point I was trying to make is that an external DNS needs to be trusted, and that the FGT knows one. I usually block all DNS from internal to internet as the hosts should use the (Windows server) internal DNS which in turn uses the FGT as external DNS.

[Yurisk · Accepted solution]

No clear answer here, but I'll start with an observation - having seen few hundreds of  Fortigates so far in my career, I am yet to recall a single one with the Slave DNS zone configured.  

Now as an exercise in logic, Slave zones are mostly used to lower load on the authoritative DNS server | decrease latency in DNS queries for clients | protect authoritative DNS from bad/malicious clients. With none of it fitting easily with Fortigate DNS serving query requests from internal networks (if your internal hosts are attacking AD DC, you've got bigger problems than DNS). 

Moreover, Windows LAN environment - using FGT instead of AD DC is possible, but FGT does not support SRV records, which are crucial for Windows environment. 

In summary - I don't see any business need for this feature, nor ever tried one.

[JerryPWhite1]

Thanks for all the info. This might sound weird but what a great community.

[Gabrielhm]

Personal choice, mostly. Both versions will work just fine.

You can only forward to their services if you are okay with Cloudflare/Google DNS/OpenDNS knowing every domain you visit and potentially doing bad stuff with that knowledge. In general, they are quicker than querying the root servers directly. Querying root servers enables you to bypass a single entity that has all your queries (except your ISP), however traffic can not be encrypted, whereas DNS over TLS is already provided by Cloudflare (probably Google too).

DNSSEC is useless since it does not have encryption, it just verifies the response of the server.