FG can't resolve any hostnames - Clients working fine

FGNoobUser1 · ‎05-26-2022

Hi,

a few days before, we made the Update 6.4.8 to 6.4.9. After this, the FG can't resolve any Hostnames.

Ping with FQDN on FG CLI says "unable to resolve hostname". All rules that use FQDN doesn't work anymore. If I ping the IP-Address the FG is working fine. He also can ping the DNS. We didn't change any other configuration on the FG.

Only thing I did after Update was this, cause I couldn't reach the GUI: "set admin-server-cert Fortinet_Factory"

FG has configured the same DNS like every client in the network and all clients working fine!

It is a FG100F. There is nothing special configured: In DNS-Settings there is only our DNS-Server / DC set with it's IP. I don't know what to do anymore. I tried to contact the support but for every answer they take about 2 days. I hope the FG community can help a little faster.

AEK · ‎05-27-2022

Yes it is a slave DNS server and the server doesn't allow it to fetch the zone.

So in case you want your FGT to be a slave DNS server for your local domain then just allow it to fetch the DNS zone on your primary DNS server. Otherwise just unconfigure it as secondary DNS server.

AEK

View solution in original post

FGNoobUser1 · ‎05-27-2022

GREAT. It's working. Thank you very much.

I deleted the secondary DNS and now it's working. It's strange because we had this configuration for months and it was working until I made the Update.

I know we configured this, cause we have split-tunneling and everytime we wanted to reach a FQDN from and VPN-Client, he didn't send the request to the VPN, instead he was sending it to the internet. But he just did this sometimes. And sometimes it was working.

Do you think I get this problem again with this configuration?

AEK · ‎05-27-2022

If you want your VPN clients to resolve internal hostnames, configure your SSL VPN to set DNS server IP for the VPN clients to your internal DNS server IP, not FortiGate IP.

In case for some reason it is required to have your FortiGate as the DNS server for the clients, then do this depending on your design considerations:

- Either configure FGT as DNS forwarder server (forward requests to internal DNS)

- Or configure it back to be a slave DNS server but allow it to fetch DNS Zone on the primary DNS server

As a final advice, managing a production FGT may not be always simple, better get NSE4 training

AEK