DNS settings on branch best practices

[Tutek]

Hi,

how do you recommend to configure dns on branch fortigate, all traffic is routed to hq fortigate, on hq fortigate is localed domain server dns.
On branch lan users get dns from settings "Same as interface IP"

Now in dns settings I set "Primary DNS server": Ip of domain server at HQ

secondary ip: leave empty.

Is this ok? I would like to all dns request go to domain dns, but would be great if branch fortigate has something like "dns cache" to not to overload vpn links.

[Markus_M]

Hi Tutek,

it will depend on your requirements. Make sure to get the requirements and then you can design to meet these.

Consider the tunnel is down, DNS over the tunnel would get the users offline. If the requirement is that ALL traffic is handled by HQ, then this is an expected bad scenario, focus on the stability of the tunnel.

Otherwise, see that you have a local DNS server that serves requests locally and forwards to the HQ in case it doesn't know. That saves traffic through the tunnel.

If there is generic traffic, like search engines that are not required to go through the tunnel, you can also add that in and your FortiGate routes it directly through its WAN rather than through the tunnel.

The consideration there is to not use up HQs internet line by the branch site.

Best regards,

Markus

[Tutek]

Force all traffic to HQ is a must (no utm scanning possible at branches) that is, we accept that in case of loss of the tunnel there will be no Internet at branch.

But don't know how to configure local dns cache at branch side when the most visited local servers or websites are catched and there is no need to query the ad server every time.

Is this config ok for DNS database?:

[anikolov]

Hello Tutek,

I suggest the following KB for the DNS forward:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-DNS-conditional-forwarding/ta-p/196821

You can check the DNS cache with "diag test application dnsproxy 3":
https://community.fortinet.com/t5/FortiGate/Technical-Note-FortiGate-Troubleshooting-DNS-commands/ta...

The default cache is 30 minutes.

Here is the command how to set it:

config system dns
 set set dns-cache-ttl (60 to 86400 (seconds))
end

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/903162/important-dns-cli-commands

Regards,

[Tutek]

one crucial thing is missing from this tutorial does dns-database entry is primary or it is slave, because mine configuration is the same but I choosed dns-database entry to be slave, and don't know if this is ok.

Command: diag test application dnsproxy 3
do not list me all cached entries but only DNS configuration like:

DNS_CACHE: hash-size=2048, ttl=1800, min-ttl=60, max-num=5000

is there a way to list all cached dns entries?