DNS Split: resolve internal and external names local on the fortigate on different servers?

[topcu]

Hello all,

this request regards to DNS name resolution on the fortigate local only!

The configuration of the firewall was changed to per-VDOM dns, because FQDN objects in that vdom should be resolved by an external nameserver. But unfortunately this leads to problems with the resolution of configured firewall users. The fortigate needs to resolve names for the following purposes:

1. Names of local configured servers (LDAP, RADIUS, etc)

2. Names from configured FQDN policy objects

1. must be resolved from the internal nameserver

2. should be resolved from an external nameserver

Is there a way to fix this?

Version 6.2.2

Many thanks in advance. Regards, Hakan

[pa_iva]

Hi,

You can define the primary dns server as your internal nameserver, define the local domain name, and use as secondary an external DNS server:

DNS settings

DNS resolution internal/external

[topcu]

Hi pa_iva, many thanks for your reply.

Yes, actually this works. I built this in a lab and did packet captures. The Fortigate is always asking both, the primary and secondary, regardless which domain is asked, and it will get an answer of one of both servers. But with this configuration I would loose the redundancy of the namservers. Means, if the primary fails, resolution of internal names would fail. Even if this works, I cannot implement this in our productive network.

Best regards, Hakan