DNS forwarding does not work in Active-Active

[opti2k4]

Hi, i have Fortigate 40C (fw 5.2.0) wich 2 WAN connections configured yesterday. So my requirement was that both connection are active at the time, one connection is used only for site-to-site VPN and other connection is only used for Internet access. Failover must not be allowed. So i' ve managed to set that up but there is 1 small problem. Clients used Fortigate LAN IP as DNS server and now that IP is not returing anything on DNS quires. When i put some public DNS on the client (8.8.8.8 for example) DNS works. Anyone maybe know what could be the problem? Thanks

[opti2k4]

To be more specific, recursive DNS is not working. I had it setup before i configured dual WAN and it worked, but now LAN IP does not give me any DNS response.

[Sean_Toomey_FTNT]

Hi opti2k4, First some design talk., virtual-wan-link is intended to either load balance or failover between internet connections.. Sounds like your use case is different. Pls ensure you do not have virtual lan link enabled. Just have two WAN ports. Put the internet in wan1 and the connection for VPN in wan2. Configure policy routing so that any traffic destined for the remote IPSec endpoint goes out Wan2, this will ensure your VPN traffic goes out the right circuit. Now write a rule to wan1 blocking the IP of the remote IPsec endpoint, and a rule beneath to allow internet access. That ensures your VPN traffic will never go out wan1 while providing internet access to others Thats the design piece. Pls ensure you have the DNS server enabled correctly on the internal facing interface on the firewall, and that it' s configured properly. None of the work you did should have affected the DNS server on the firewall, I can' t imagine it was enabled on the WAN ports. You can try pasting the DNS server config you have (redacting any confidential info) for review, but it' s hard to say if that' s the ultimate cause without knowing the rest of the config. I could also suggest that you open a TAC case and include a backup of config as well as diag debug report / exe tac report. Hope that helps! Cheers!

[ede_pfau]

hi, the relevant sections of the config file are config system dns-database and config system dns-server Please post these to let us get a notion what you have set up. In the back of my mind I found a note that on a 40C there is no local DNS database. Units below a FG60x suffer from (random) FortiOS features being withheld. (That was nasty, you could put it this way: " due to limited ressources on the smallest units (20,30,40) some rarely used features of FortiOS have been disabled, to ensure reliable operation of the FGT" ). I' ll check that on my 40C.

[techevo]

You say if you use public DNS like 8.8.8.8 it works. Could it be that your using DNS from ISP A with internet connection on ISP B ? Most ISP will only respond to DNS queries from IP addresses that belong to then. If you system DNS is setup with DNS that belong to your first ISP and you are sending queries to the other ISP ( via the other wan link ) that very possible it will not return anything. Using a public dns will solve this problem. If you cannot do that maybe use for primary DNS the DNS of the most used IPS and for secondary DNS the DNS of the second ISP. At least as a test to see if i' m pointing you in the right direction. I don' t know what is your dual ISP setup so it' s hard to find the best solution for you. Let me know I will try to help you more.