DNS Forwarding Issue on FortiGate

[aedcce]

Hello Everyone,

I have a question regarding DNS forwarding. Unfortunately, I have little experience with DNS on the FortiGate, so please be patient with me.

At the moment, I have a Jump Host VLAN that needs to access the DNS servers of two different networks. The goal is that, for example, when I query the domain NetworkA.local, the request is forwarded to the DNS server in Network A, and when I query NetworkB.local, the request is forwarded to the DNS server in Network B.

Network A is configured on the same FortiGate as the Jump Host VLAN, while Network B is located on a second FortiGate connected via an IPSec tunnel. I have configured the DNS server on the Jump Host VLAN as recursive and set up the DNS database accordingly as a forwarder.

Now, here’s the problem: DNS forwarding works for Network A, but not for Network B. I suspect the issue is that the FortiGate does not use the interface IP of the Jump Host VLAN to forward DNS queries, which is why the requests are not being passed through. When I send the DNS queries directly from a client to the respective server, it works (so policies and routing should not be the issue).

Is it possible to send the DNS forwarding queries from the interface IP?
Or have I misunderstood the concept entirely?

[davidsamalans]

---

@aedcce 부비 wrote:

Hello Everyone,

I have a question regarding DNS forwarding. Unfortunately, I have little experience with DNS on the FortiGate, so please be patient with me.

At the moment, I have a Jump Host VLAN that needs to access the DNS servers of two different networks. The goal is that, for example, when I query the domain NetworkA.local, the request is forwarded to the DNS server in Network A, and when I query NetworkB.local, the request is forwarded to the DNS server in Network B.

Network A is configured on the same FortiGate as the Jump Host VLAN, while Network B is located on a second FortiGate connected via an IPSec tunnel. I have configured the DNS server on the Jump Host VLAN as recursive and set up the DNS database accordingly as a forwarder.

Now, here’s the problem: DNS forwarding works for Network A, but not for Network B. I suspect the issue is that the FortiGate does not use the interface IP of the Jump Host VLAN to forward DNS queries, which is why the requests are not being passed through. When I send the DNS queries directly from a client to the respective server, it works (so policies and routing should not be the issue).

Is it possible to send the DNS forwarding queries from the interface IP?
Or have I misunderstood the concept entirely?

---

Yes, you can configure DNS forwarding to use the interface IP by setting up the DNS server on the FortiGate to forward based on domain names to specific IP addresses.