we have a FGT 60C and a Windows 2003 DC with DNS.
Is it possible to use the FGT as Backup DNS-Server (slave mode?). So if the Windows Server is down, the Clients should be able to resolve DNS-Queries over the FGT - inclusive some internal IPs p.ex. Webservers.
I have activated the DNS-GUI, created a non autorative shadow slave. on the Windows Server I' ve added the FGT IP for zone transfer for reverse and forward zone.
One problem with a secondary DNS is that the clients wait a long time before querying the secondary if the primary is down (~ 20 sec). Browsing (with many URL lookups) is a pain then.
If you are willing to manually ' switch over' the FGT can help you:
- create a VIP on the internal interface with an unused local IP address
- activate the mapping in a ' internal->internal' firewall policy
- map to your primary DNS
- put the VIP into your DHCP configuration as DNS
Your clients will query the virtual IP now, not the real server' s IP.
If you schedule a server downtime, change the VIP ' mapped-to' IP to the Fortigate' s internal interface IP.
Of course, the FGT' s DNS must query recursively, i.e. names it doesn' t know must be forwarded to your ISP.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.