Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
JoeBucar
New Contributor

Fortigate 60D as Primary DNS

Hello,

 

I have been trying to find a way to setup the Fortigate 60D as the Primary DNS in the NIC card on a PC connected to the router without success.  I want to do this so I only have one place to change the DNS if I have the need.

Thank You,

 

Joe  

17 REPLIES 17
Fullmoon
Contributor III

System>Config>Features>Enable DNS Database then see attached images Step1 and 2

Fortigate Newbie

Fortigate Newbie
Fullmoon

step2

Fortigate Newbie

Fortigate Newbie
Dave_Hall
Honored Contributor

JoeBucar wrote:

I have been trying to find a way to setup the Fortigate 60D as the Primary DNS in the NIC card on a PC connected to the router without success.  I want to do this so I only have one place to change the DNS if I have the need.

 

If the Fortigate is handling DHCP requests, you can pretty much define what DNS server IP(s) are handed out to the clients.   You can either 1) define the DNS IP addresses directly in the DHCP server section or 2) instruct the Fortigate is hand out the DNS IP addresses itself uses.

 

 

The DNS Database option that Fullmoon posted is another option, but the option may not available on the lower-end Fortigate models (at least on 5.x firmware). 

 

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
JoeBucar

Hello,

 

Thank You for the responses.  That is my main problem I have a SBS 2011 and it is handing out DHCP and that is what I elected to do. But, I have other machines on the network other than the machines in the SBS domain that have static IP's.  These machines are the one that I want to use the Fortigate 60d as the primary DNS on the NIC card.

 

Thank You,

 

Joe

 

   

 

Dave_Hall
Honored Contributor

JoeBucar wrote:

[...] But, I have other machines on the network other than the machines in the SBS domain that have static IP's.  These machines are the one that I want to use the Fortigate 60d as the primary DNS on the NIC card.

Never actually thought about it, but I was under the impression that any DNS request sent directly to the Fortigate would automatically be forwarded to the IP address(s) defined in the system DNS settings option.

 

If we were taking about clients connecting to a company public wifi, I usually just set the DNS to Google (8.8.8.8, 8.8.4.4).

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
JoeBucar

Hello,

 

That was the impression I was under also.  If I put the Fortigate IP address (192.168.210.x) in the NIC's DNS primary it does not resolve addresses on that machine, although the Fortigate's CLI does resolve them.  Also I can not use Google but that is another story.

 

Thank You,

Joe  

Dave_Hall
Honored Contributor

Maybe try debug flow...

 

diag debug reset diag debug flow filter saddr <source IP address> diag debug flow filter dport 53 diag debug flow show console enable diag debug flow trace start 1000 diag debug en

 

 

 

 

 

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
JoeBucar

Hello,

This is what came back on the CLI

FGT60D4613031154 # id=13 trace_id=7 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:61368->192.168.210.1:53) from internal. " id=13 trace_id=7 func=init_ip_session_common line=4469 msg="allocate a new session-000001dd" id=13 trace_id=7 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=8 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:29156->192.168.210.1:53) from internal. " id=13 trace_id=8 func=init_ip_session_common line=4469 msg="allocate a new session-000001de" id=13 trace_id=8 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=9 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:61368->192.168.210.1:53) from internal. " id=13 trace_id=9 func=init_ip_session_common line=4469 msg="allocate a new session-000001df" id=13 trace_id=9 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=10 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:29156->192.168.210.1:53) from internal. " id=13 trace_id=10 func=init_ip_session_common line=4469 msg="allocate a new session-000001e0" id=13 trace_id=10 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=11 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:61368->192.168.210.1:53) from internal. " id=13 trace_id=11 func=init_ip_session_common line=4469 msg="allocate a new session-000001e1" id=13 trace_id=11 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=12 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:29156->192.168.210.1:53) from internal. " id=13 trace_id=12 func=init_ip_session_common line=4469 msg="allocate a new session-000001e2" id=13 trace_id=12 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=13 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:61368->192.168.210.1:53) from internal. " id=13 trace_id=13 func=init_ip_session_common line=4469 msg="allocate a new session-000001e3" id=13 trace_id=13 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=14 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:29156->192.168.210.1:53) from internal. " id=13 trace_id=14 func=init_ip_session_common line=4469 msg="allocate a new session-000001e4" id=13 trace_id=14 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=15 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:61368->192.168.210.1:53) from internal. " id=13 trace_id=15 func=init_ip_session_common line=4469 msg="allocate a new session-000001e7" id=13 trace_id=15 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=16 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:29156->192.168.210.1:53) from internal. " id=13 trace_id=16 func=init_ip_session_common line=4469 msg="allocate a new session-000001e8" id=13 trace_id=16 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop"

 

Before I did the commands I verified that I could ping www.yahoo.com from the CLI and I could not successfully ping www.yahoo.com from the PC.

 

Thank You,

Joe

ede_pfau
Esteemed Contributor III

The FGT will not act as an DNS unless you instruct it to.

This needn't be so messy - just follow the 2 steps Fullmoon has already posted and then the FGT will respond to DNS requests. The debug clearly states that these requests are dropped, there's nobody listening on the FGT.


Ede

"Kernel panic: Aiee, killing interrupt handler!"
Ede"Kernel panic: Aiee, killing interrupt handler!"
Labels
Top Kudoed Authors