Fortinet Community

Heshmatkhah · ‎04-27-2022

Hi

I'm running FortiOS v7.2.0,build1157,220331 on FortiGate-200E

I enabled DNS Database in Feature Visibility and configured it like this:

config system dns
    set primary 1.1.1.1
    set secondary 1.0.0.1
    set protocol cleartext dot doh
    set server-hostname "one.one.one.one"
    set domain "test.local"
end

config system dns-server
    edit "port3"
        set mode forward-only
    next
end

config system dns-database
    edit "Test"
        set domain "test.local"
        set view public
        set authoritative enable
        config dns-entry
            edit 1
                set hostname "@"
                set ip 192.168.5.15
            next
            edit 2
                set hostname "asd"
                set ip 192.168.5.15
            next
        end
        set primary-name "dns1"
        set contact "host@test.local"
    next
end

(The IP Address of port3 is 192.168.5.1)

The firewall doesn't respond to DNS for this domain and forwards the request to other DNS servers instead of resolving it from the local database

I tried dig for these domains and all of them failed to resolve:

asd.test.local
asd (should work because test.local is set in the Local domain name in DNS)
test.local

How can I fix this?

AlexC-FTNT · ‎04-28-2022

Your DNS server seems to be set to forward-only, which will only forward to the public DNS configured, without checking the local database.

https://community.fortinet.com/t5/Fortinet-Forum/What-s-difference-between-recursive-non-recursive-a...

- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -

View solution in original post

Heshmatkhah · ‎04-28-2022

Ok, I set the view to shadow (in addition to DNS server mod), and it works now.

But I can't understand what does internal and public users mean

Zone view (public to serve public clients, shadow to serve internal clients).
shadow: Shadow DNS zone to serve internal clients.
public: Public DNS zone to serve public clients.