Bizarre DNS results? 198.18.x.y returned

[Jond]

Hi there,

I'm getting something odd happening which I've never seen before, I am intermittently getting DNS queries answered with a 198.18.x.y address.

Using Fortiguard or local DNS servers doesn't make any difference to the behaviour.

It happens with both local clients and through the CLI on the box.

For instance:

Have to say I've no seen that before!

Any ideas?

Thanks,

Jon

[Dave_Hall · Accepted solution]

Is the Fortigate's WAN(s) interfaces configured/set to override internal DNS?

[rwpatterson]

Could you paste ASCII results from the query? Pictures don't quite work.

[Dave_Hall · Accepted solution]

Is the Fortigate's WAN(s) interfaces configured/set to override internal DNS?

[emnoc · Accepted solution]

And to add, you can diag sniffer packet any "host x.x.x.x and src port 53" to see the DNS-answers

Ken Felix

[Jond]

Dave Hall wrote:

Is the Fortigate's WAN(s) interfaces configured/set to override internal DNS?

I like your thinking, where do I find that? I've looked all over the place in the GUI and dumped out the full config on the wan interface and I see nothing standing out :(

[Dave_Hall]

The setting should be listed there unless the web browser version you are using is not 100% compatible (e.g. page element corruption.) 

The default setting is enabled I believe - all default settings won't show up when listed in the config (in the CLI) unless you use "show full".

 

Just to confirm are you getting DNS quires from host 198.18.x.y or are DNS quires resolving to 198.18.x.y ? And yeah, your original pic didn't come out.

[Jond]

Thank you to everyone who mentioned Override DNS setting.

I'd forgotten that I'd started to set up a failover ADSL link with that ticked (by default I guess) and the ADSL had failed returning the oddjob 198 addresses.

Best wishes,

Jon

[ede_pfau]

@Dave Hall's post: "override" will only be displayed if WAN type is DHCP or PPPoE.