- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please note that DNS query latency is based on when FGT system DNS sends a query, we will record the time sent. And when a query response is received, the time received will also be recorded. We calculated the latency (weighted 3:7) of the server based on these value.If there is no DNS response packet received or failed, Fortigate shows the status unreachable. Kindly check whether the Fortigate is receiving the DNS response packet from the DNS server. Also the latency value is not updated,if Fortigate do not query the server since there are no transaction of packets.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need to allow port 53 also in the incoming allow list to reach back to Fortigate.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please note that DNS query latency is based on when FGT system DNS sends a query, we will record the time sent. And when a query response is received, the time received will also be recorded. We calculated the latency (weighted 3:7) of the server based on these value.If there is no DNS response packet received or failed, Fortigate shows the status unreachable. Kindly check whether the Fortigate is receiving the DNS response packet from the DNS server. Also the latency value is not updated,if Fortigate do not query the server since there are no transaction of packets.
Created on 02-21-2022 10:19 PM Edited on 02-22-2022 01:42 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
..........
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need to allow port 53 also in the incoming allow list to reach back to Fortigate.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What incoming allow list?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I believe allow list is the firewall policy which he is specifying. Need to confirm if port 53 is allowed incase if the service is not set to all and is set to specific services.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That doesn't sound right. DNS responses are part of a connection initiated outbound. Opening port 53 to your DNS server is a bad idea.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
exactly. :D