DNS blocking

[Godfreyagr]

Hi team

I have a scenario where some end user machines are being blocked from accessing DNS yet the services in the policy are set to all services. This is affecting some machines while others are working fine

#FGT

[funkylicious]

long shot, but under the internal interface, do you have captive portal enabled ?

or if you do a show full firewall policy ID do you see the set disclaimer enable ? if so, try and disable it.

[dingjerry_FTNT]

Hi @Godfreyagr ,

In the future, if you have to share so much info, please share the screenshot here and text outputs via one online text-sharing website.

I can see that all of the logs are with Policy #5.  Could you please share the configuration of policy #5?

[Godfreyagr]

Thanks however I haven't used one online text sharing, you can assist with that if you don't mind

Below are the configs of policy id 5

edit 5
set name "vpn_S2S-Bugolobi_local_0"
set uuid 8082c6ac-e300-51ef-210f-52dd906e63aa
set srcintf "internal"
set dstintf "S2S-Bugolobi"
set action accept
set srcaddr "S2S-Bugolobi_local"
set dstaddr "S2S-Bugolobi_remote"
set schedule "always"
set service "ALL"
set utm-status enable
set ssl-ssh-profile "certificate-inspection"
set dnsfilter-profile "semuto"
set comments "VPN: S2S-Bugolobi (Created by VPN wizard)"
next
end

[adhawan]

It would appear that the traffic in question would be subject to the one describe in this KB https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Threat-131072-is-seen-in-logs-when-t...

[Godfreyagr]

from the article, the issue has nothing to do with the firewall but between the client machine and the dns server, right?