Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
EduFon
New Contributor

Domain name resolution site to site tunnel

 

Hi.
I have two offices, in office A (Argentina) I have a Forti with a domain network, Windows server with DNS.
In Office B (Mexico) I only have one Forti, I don't have any datacenter to replicate my domain.
The issue is that in the DNS of the Internal and Wifi interfaces we put the Server that I have in Office A as the name server.
This is apparently causing problems, because all the name resolution queries travel from Office B to Office A.
We have performance issues between ISPs in each country through Site to Site. What I need, is that the DNS resolution of my domain Domain.local travels through the VPN, but then everything that is browsing the internet, uses the public DNS. I hope you can guide me. Thank yo

 

3 REPLIES 3
Sheikh
Staff
Staff

Hi EduFon,

 

You can achieve this by enabling and configuring split DNS on the branch FortiGate firewall. At first you need to enable DNS Database in "Feature Visibility" of FortiGate. 

 

Login to FortiGate>>>>System>>>Feature Visibility>>>DNS Database. After it is enabled, then go to DNS Servers under Network in FortiGate. Then you need to configure DNS service and attach it to an Interface. Please ensure to check "Recursive". You can/may also apply DNS filter on it.

 

After that you need to configure DNS Database and add your local DNS Zone and Domain name. As branch FortiGate is not a the master DNS for your internal DNS Zone on active directory, so you need to select type as "Slave". Enter the required information and click OK. 

 

You may need to create a policy "or you may already have" to allow communication from the remote branch office network to your domain controllers in Site A. If the FortiGate is also acting as a DHCP server for your Branch network, then you might need to select "Same as Interface IP" for DNS Server under Network interface.

 

regards,

 

Sheikh

 

 

**If you come across a resolution, kindly show your appreciation by liking and accepting it, ensuring its accessibility for others**
gfleming
Staff
Staff

To build on @Sheikh 's excellent reply, you will also need to set up your Windows DNS server to do zone transfer to the FortiGate DNS database.

 

Under the DNS Database your configure for FortiGate you may want to put public DNS servers for non-domain lookups in the "Forwarder" section.

 

https://docs.fortinet.com/document/fortigate/6.4.10/administration-guide/960561/fortigate-dns-server

Cheers,
Graham
EduFon
New Contributor

Labels
Top Kudoed Authors