Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
johnm
New Contributor

DNS being passed when not permitted

Why is DNS traffic being passed even though it is not explicitly permitted?  Such things cause me concern.  Is it the DNS helper?

 

Version: FortiGate-500E v6.0.5,build0268,190507 (GA)

 

flow trace:

id=20085 trace_id=2449 func=print_pkt_detail line=5494 msg="vd-root:0 received a packet(proto=17, 202.xx.17.50:53743->104.44.193.243:53) from agg1.930. " id=20085 trace_id=2449 func=init_ip_session_common line=5654 msg="allocate a new session-07c990cc" id=20085 trace_id=2449 func=vf_ip_route_input_common line=2591 msg="find a route: flag=04000000 gw-122.yy.111.60 via agg1.200" id=20085 trace_id=2449 func=fw_forward_handler line=751 msg="Allowed by Policy-4294967295: SNAT" id=20085 trace_id=2449 func=__ip_session_run_tuple line=3322 msg="SNAT 202.xx.17.50->122.yy.111.61:53743" id=20085 trace_id=2449 func=__ip_session_run_tuple line=3373 msg="run helper-dns-udp(dir=original)"

John

John
1 REPLY 1
johnm
New Contributor

a bit more info... so it appears to be the "implicit-allow-dns".  I believe that may be set when choosing NGFW Policy-mode.  The problem is that "implicit" rule does not use the central SNAT policy, and does an interface SNAT regardless.  bug?

 

https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-firewall/Concepts%20-%20Firewall/DNS...

 

John

John
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors