External DNS Server Unreachable

[jhussain_FTNT · Accepted solution]

Please note that DNS query latency is based on when FGT system DNS sends a query, we will record the time sent. And when a query response is received, the time received will also be recorded. We calculated the latency (weighted 3:7) of the server based on these value.If there is no DNS response packet received or failed, Fortigate shows the status unreachable. Kindly check whether the Fortigate is receiving the DNS response packet from the DNS server. Also the latency value is not updated,if Fortigate do not query the server since there are no transaction of packets.

[cp3]

...

[jhussain_FTNT · Accepted solution]

Please note that DNS query latency is based on when FGT system DNS sends a query, we will record the time sent. And when a query response is received, the time received will also be recorded. We calculated the latency (weighted 3:7) of the server based on these value.If there is no DNS response packet received or failed, Fortigate shows the status unreachable. Kindly check whether the Fortigate is receiving the DNS response packet from the DNS server. Also the latency value is not updated,if Fortigate do not query the server since there are no transaction of packets.

[cp3]

..........

[jhussain_FTNT · Accepted solution]

You need to allow port 53 also in the incoming allow list to reach back to Fortigate.

[commin2ulive]

What incoming allow list?

[FortiNitish]

I believe allow list is the firewall policy which he is specifying. Need to confirm if port 53 is allowed incase if the service is not set to all and is set to specific services.

[Hueyii]

That doesn't sound right.  DNS responses are part of a connection initiated outbound.  Opening port 53 to your DNS server is a bad idea.

[Hueyii]

exactly.  :D