DNS Server in the Interface set as Interface IP

[martyyy]

Hi,

In one of our Interface (Explorer Data), the DNS Server was set as "Same as Interface IP".
1. What DNS will the end device will be getting? We would like to know what DNS it was using if the end device uses FQDN, how it resolves its FQDN to IP Address.

DNS Servers - Specify
Primary DNS server - 1.1.1.1
Secondary DNS - 8.8.8.8

2. For the "dynamically obtained DNS server", what is its purpose? Is it the "same as interface IP", and would this be used to rely on the DNS server or FortiGuard?"

Appreciate your comments and Thank you in advance.

[pminarik]

The client will get the IP of that interface.

E.g. if you are editing interface "port1" with IP 192.168.123.45 and select DNS='same as interface IP', DHCP will give 192.168.123.45 as the DNS server IP.
Warning: There is no verificaction if the DNS server is enabled on this interface/IP. That is up you you to do separately.

Thus the three options are:

"same as interface IP": Client's DNS IP will be the IP of this FGT interface.

"same as system DNS": Client's DNS IPs will be the IPs configured in Network > DNS (in FGT GUI)

"specify": manually set here to anything you want.

-----------------------------

"Dynamically obtained DNS servers": This is a list of DNS servers learned from upstream DHCP/PPPoE. It only shows when one of your FGT interfaces is a DHCP/PPPoE client and it received a DNS IP from there. You may or may not use it, depending on the interface's setting. ("override internal DNS = enable" => use the DHCP/PPPoE-learned DNS IP)

[martyyy]

Hi @pminarik ,

Appreciate your response.

Just to add, Client's DNS IP will be the IP of this FGT interface.

how or what is the process to resolve FQDNs if the DNS is the FGT interface?

Thank you!

[pminarik]

You need to enable and configure DNS resolver on that interface/IP.
1, System > Feature Visibility > make sure "DNS Database" is enabled (to see the options in the GUI)

2, Network > DNS Servers > DNS Service on Interface

[martyyy]

Hi @pminarik ,

Yes, we have enabled that.

[kwcheng__FTNT]

It should be the same as the standard DNS resolution process, whether your FortiGate is a reclusive or non-reclusive DNS.