DNS issue

[zeno]

Hi everyone   I'm new here and i hope someone can help me with my problem   our customer network looks like : stack core switches ---- routers ---- Fortigate --- internet mpls----Fortigate---- datacenter   in core switches 3 vlans are configured 1- vlan 16 for it.local 2- vlan 1 for dsvm 3- vlan 17 4- vlan 18 dmz  (new)    they asked me to create new vlan in same way as the other vlans, after that they asked vlan 16 should talk see vlan 18 so i what i have configured in fortigate : 1- Nat (VIP) port( http and tcp -8080) 2- ipv4 policy allowed source (all) to destination (VIP) 3- static route for the new range same way as others 4- from the vlans interface to trust interface allowed all -- all   what i achieved is : 1- i can ping from range vlan 16 to vlan 18 and the same for vlan 18 2- dns servers for all is in range vlan 16 10.50.16.31 10.50.16.32 3- i can ping from server in vlan 18 to these dns servers 4- i can telnet port 53 in vlan 18   the problem that i face right now 1- i cannot access any website/page when i use the dns servers although i can ping them 2- but when i change it to google dns everything is working properly but this is not a good plan to keep it in public dns i have tried a lot to figure it out but without hope so can i get some help with that ?????

[Toshi_Esumi]

Probably the problem is on the DNS server side but you need to do:

1. sniffing on vlan 16 side while sending DNS requests to see if they're actually leaving the FGT

2. "flow debug" to see any reason if they're dropped, or not

to prove the FGT are forwarding those to the servers.

[rwpatterson]

toshiesumi wrote:
Probably the problem is on the DNS server side but you need to do:

+1 from me. Make sure your forwarders on the DNS server can be reached and are available through your ISP. For example, Verizon will not permit you to use their DNS servers from a Spectrum IP address. Just because it can be reached by a PING doesn't necessarily mean you can actually use it for DNS lookups.

[zeno]

Hi 

Thanks for your reply 

can you please explain more i don't have so much knowledge regarding to fortigate devices 

Probably the problem is on the DNS server side but you need to do: 1. sniffing on vlan 16 side while sending DNS requests to see if they're actually leaving the FGT ??--- how can make sniffing ??? 2. "flow debug" to see any reason if they're dropped, or not --- how can i do that ??? to prove the FGT are forwarding those to the servers.

last thing the dns servers used for all the virtual servers and the other virtual servers have no problem using dns servers for any range so i thing the problem is limited only to this virtual server but i can't figure it out i spent around 3 weeks but unfortunately couldn't solve it