Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Rick_H
New Contributor III

DNS re-write

We have recently completed migrating from a Cisco ASA platform to FortiGate 100Ds (we originally bought our FG100Ds to replace our Websense webfilter and decided to use them as the firewalls later). The migration went pretty well with only a few hiccups mostly stemming from my learning curve. As full-featured as the FG100Ds are there is one feature that the ASA has that I have not been able to find in FortiOS: DNS rewrite. When configured to do so, the ASA can rewrite the responses to DNS queries that pass across an interface pair. The rewrite function allows the ASA to replace the " true" addresses with translated ones in the DNS reply. Under the ASA we had leveraged this feature heavily. The specific use case was that we were obfuscating our internal network addressing from the DMZ with static one-to-one NATs for inside hosts that DMZ hosts needed to communicate with. Using this feature we were able to point our DMZ hosts at internal DNS servers and still have those DNS queries return the translated addresses via the rewrite feature instead of the true, internal addresses. We ended up just using HOSTS files to get around this. The HOSTS files work just fine, but feel cludgy compared to doing it at the firewall level. If anyone is aware of a way to replicate this ASA feature within FortiOS (we' re on 4.3.10) I' d be grateful to hear it! Cheers, Rick
5 REPLIES 5
Dave_Hall
Honored Contributor

Not sure if this is what you are after...

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
Rick_H
New Contributor III

I think this is exactly what I' m looking for. Thank you!!
rwpatterson
Valued Contributor III

A simple Virtual IP definition should do the same thing as well.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Rick_H
New Contributor III

Bob, in my experience so far the Virtual IP alone does not handle it. I had become accustomed to this setting in the ASA and didn' t even think twice when I setup all of my NATs in the FortiGate. I have two hosts in my DMZ that are connected to my AD on the inside and these two hosts just flat would not function after the migration to the FG100D. During troubleshooting I found that DNS queries for the hosts they needed were returning actual addresses instead of the translated ones. When I put entries in the HOSTS file to resolve the names locally to the translated addresses it all started working. I am in 4.3.x, though. Perhaps this was automatic in prior versions?
rwpatterson
Valued Contributor III

Grrrr... You are correct.... I was only thinking of the initial calls to the DNS servers, not the returned requests. A VIP(s) would work in concert with a DNS zone containing the aliased addresses though.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors