FAZ200D - duplicated hostname of clients

[bcominotti]

Hi All,

we recently deployed a FAZ200D, it's receiving logs from 2 FG200B in HA (a-p) mode. The clients comes from various routed networks on the internal interface and reach the internet via FG200B.

There is a "strange" problem:

The problem is that we see (in FAZ) many clients with different IP address resolved with the same name, seems that only those on local network (local to the FG) are resolved correctly, from the other subnet there are 30-40 clients resolved all with the same name, for every subnet, but the same name appear only on a single subnet and is effectively a name of a client of that network...

The FAZ is configured with internal DNS, that resolves correctly the names via reverse lookup.

Firmware version is 5.2.1 on FAZ, 5.0.8 on FGs.

Anyone can help ?

Thanks in advance,

Bruno

[AtiT]

Hello Bruno,

A network diagram should help.

You said that the names were resolved correctly for the Fortigate local network. Do you mean local network as L2?

The clients are not resolved correctly are behind some L3 equipment like a router?

Maybe some expamle will help also.

[bcominotti]

Hello AtiT,

yes, the only clients that are resolved correctly are those on the same ip network of the fortigate, the other networks are routed by the L3 switches connecting the various buidings, the FGT knows the remote networks via static routes to the L3 switches.

Example:

- the FGT has IP 192.168.1.200/24

- the FTG has static route to network 192.168.2.0/24 via GW 192.168.1.102

- the FTG has static route to network 192.168.3.0/24 via GW 192.168.1.103

- and so on...

- clients on the subnet 192.168.1.0/24 are resolved correctly

- clients on the subnet 192.168.2.0/24 are resolved with 1 name (that is the name of a real client)

- clients on the subnet 192.168.3.0/24 are resolved with 1 name (that is the name of a real client)

Thanks,

Bruno