DNS re-write

[Rick_H]

We have recently completed migrating from a Cisco ASA platform to FortiGate 100Ds (we originally bought our FG100Ds to replace our Websense webfilter and decided to use them as the firewalls later). The migration went pretty well with only a few hiccups mostly stemming from my learning curve. As full-featured as the FG100Ds are there is one feature that the ASA has that I have not been able to find in FortiOS: DNS rewrite. When configured to do so, the ASA can rewrite the responses to DNS queries that pass across an interface pair. The rewrite function allows the ASA to replace the " true" addresses with translated ones in the DNS reply. Under the ASA we had leveraged this feature heavily. The specific use case was that we were obfuscating our internal network addressing from the DMZ with static one-to-one NATs for inside hosts that DMZ hosts needed to communicate with. Using this feature we were able to point our DMZ hosts at internal DNS servers and still have those DNS queries return the translated addresses via the rewrite feature instead of the true, internal addresses. We ended up just using HOSTS files to get around this. The HOSTS files work just fine, but feel cludgy compared to doing it at the firewall level. If anyone is aware of a way to replicate this ASA feature within FortiOS (we' re on 4.3.10) I' d be grateful to hear it! Cheers, Rick

[Dave_Hall]

Not sure if this is what you are after...

[Rick_H]

I think this is exactly what I' m looking for. Thank you!!

[rwpatterson]

A simple Virtual IP definition should do the same thing as well.

[Rick_H]

Bob, in my experience so far the Virtual IP alone does not handle it. I had become accustomed to this setting in the ASA and didn' t even think twice when I setup all of my NATs in the FortiGate. I have two hosts in my DMZ that are connected to my AD on the inside and these two hosts just flat would not function after the migration to the FG100D. During troubleshooting I found that DNS queries for the hosts they needed were returning actual addresses instead of the translated ones. When I put entries in the HOSTS file to resolve the names locally to the translated addresses it all started working. I am in 4.3.x, though. Perhaps this was automatic in prior versions?

[rwpatterson]

Grrrr... You are correct.... I was only thinking of the initial calls to the DNS servers, not the returned requests. A VIP(s) would work in concert with a DNS zone containing the aliased addresses though.