Fortigate 60D as Primary DNS

[JoeBucar]

Hello,

I have been trying to find a way to setup the Fortigate 60D as the Primary DNS in the NIC card on a PC connected to the router without success.  I want to do this so I only have one place to change the DNS if I have the need.

Thank You,

Joe  

[Fullmoon]

System>Config>Features>Enable DNS Database then see attached images Step1 and 2

[Fullmoon]

step2

[Dave_Hall]

JoeBucar wrote:

I have been trying to find a way to setup the Fortigate 60D as the Primary DNS in the NIC card on a PC connected to the router without success.  I want to do this so I only have one place to change the DNS if I have the need.

If the Fortigate is handling DHCP requests, you can pretty much define what DNS server IP(s) are handed out to the clients.   You can either 1) define the DNS IP addresses directly in the DHCP server section or 2) instruct the Fortigate is hand out the DNS IP addresses itself uses.

The DNS Database option that Fullmoon posted is another option, but the option may not available on the lower-end Fortigate models (at least on 5.x firmware). 

[JoeBucar]

Hello,

Thank You for the responses.  That is my main problem I have a SBS 2011 and it is handing out DHCP and that is what I elected to do. But, I have other machines on the network other than the machines in the SBS domain that have static IP's.  These machines are the one that I want to use the Fortigate 60d as the primary DNS on the NIC card.

Thank You,

Joe

[Dave_Hall]

JoeBucar wrote:

[...] But, I have other machines on the network other than the machines in the SBS domain that have static IP's.  These machines are the one that I want to use the Fortigate 60d as the primary DNS on the NIC card.

Never actually thought about it, but I was under the impression that any DNS request sent directly to the Fortigate would automatically be forwarded to the IP address(s) defined in the system DNS settings option.

If we were taking about clients connecting to a company public wifi, I usually just set the DNS to Google (8.8.8.8, 8.8.4.4).

[JoeBucar]

Hello,

That was the impression I was under also.  If I put the Fortigate IP address (192.168.210.x) in the NIC's DNS primary it does not resolve addresses on that machine, although the Fortigate's CLI does resolve them.  Also I can not use Google but that is another story.

Thank You,

Joe  

[Dave_Hall]

Maybe try debug flow...

diag debug reset diag debug flow filter saddr <source IP address> diag debug flow filter dport 53 diag debug flow show console enable diag debug flow trace start 1000 diag debug en

[JoeBucar]

Hello,

This is what came back on the CLI

FGT60D4613031154 # id=13 trace_id=7 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:61368->192.168.210.1:53) from internal. " id=13 trace_id=7 func=init_ip_session_common line=4469 msg="allocate a new session-000001dd" id=13 trace_id=7 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=8 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:29156->192.168.210.1:53) from internal. " id=13 trace_id=8 func=init_ip_session_common line=4469 msg="allocate a new session-000001de" id=13 trace_id=8 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=9 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:61368->192.168.210.1:53) from internal. " id=13 trace_id=9 func=init_ip_session_common line=4469 msg="allocate a new session-000001df" id=13 trace_id=9 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=10 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:29156->192.168.210.1:53) from internal. " id=13 trace_id=10 func=init_ip_session_common line=4469 msg="allocate a new session-000001e0" id=13 trace_id=10 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=11 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:61368->192.168.210.1:53) from internal. " id=13 trace_id=11 func=init_ip_session_common line=4469 msg="allocate a new session-000001e1" id=13 trace_id=11 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=12 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:29156->192.168.210.1:53) from internal. " id=13 trace_id=12 func=init_ip_session_common line=4469 msg="allocate a new session-000001e2" id=13 trace_id=12 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=13 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:61368->192.168.210.1:53) from internal. " id=13 trace_id=13 func=init_ip_session_common line=4469 msg="allocate a new session-000001e3" id=13 trace_id=13 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=14 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:29156->192.168.210.1:53) from internal. " id=13 trace_id=14 func=init_ip_session_common line=4469 msg="allocate a new session-000001e4" id=13 trace_id=14 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=15 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:61368->192.168.210.1:53) from internal. " id=13 trace_id=15 func=init_ip_session_common line=4469 msg="allocate a new session-000001e7" id=13 trace_id=15 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=16 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:29156->192.168.210.1:53) from internal. " id=13 trace_id=16 func=init_ip_session_common line=4469 msg="allocate a new session-000001e8" id=13 trace_id=16 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop"

Before I did the commands I verified that I could ping www.yahoo.com from the CLI and I could not successfully ping www.yahoo.com from the PC.

Thank You,

Joe

[ede_pfau]

The FGT will not act as an DNS unless you instruct it to.

This needn't be so messy - just follow the 2 steps Fullmoon has already posted and then the FGT will respond to DNS requests. The debug clearly states that these requests are dropped, there's nobody listening on the FGT.