Hello,
I have been trying to find a way to setup the Fortigate 60D as the Primary DNS in the NIC card on a PC connected to the router without success. I want to do this so I only have one place to change the DNS if I have the need.
Thank You,
Joe
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
JoeBucar wrote:I have been trying to find a way to setup the Fortigate 60D as the Primary DNS in the NIC card on a PC connected to the router without success. I want to do this so I only have one place to change the DNS if I have the need.
If the Fortigate is handling DHCP requests, you can pretty much define what DNS server IP(s) are handed out to the clients. You can either 1) define the DNS IP addresses directly in the DHCP server section or 2) instruct the Fortigate is hand out the DNS IP addresses itself uses.
The DNS Database option that Fullmoon posted is another option, but the option may not available on the lower-end Fortigate models (at least on 5.x firmware).
NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
Hello,
Thank You for the responses. That is my main problem I have a SBS 2011 and it is handing out DHCP and that is what I elected to do. But, I have other machines on the network other than the machines in the SBS domain that have static IP's. These machines are the one that I want to use the Fortigate 60d as the primary DNS on the NIC card.
Thank You,
Joe
JoeBucar wrote:[...] But, I have other machines on the network other than the machines in the SBS domain that have static IP's. These machines are the one that I want to use the Fortigate 60d as the primary DNS on the NIC card.
Never actually thought about it, but I was under the impression that any DNS request sent directly to the Fortigate would automatically be forwarded to the IP address(s) defined in the system DNS settings option.
If we were taking about clients connecting to a company public wifi, I usually just set the DNS to Google (8.8.8.8, 8.8.4.4).
NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
Hello,
That was the impression I was under also. If I put the Fortigate IP address (192.168.210.x) in the NIC's DNS primary it does not resolve addresses on that machine, although the Fortigate's CLI does resolve them. Also I can not use Google but that is another story.
Thank You,
Joe
Maybe try debug flow...
diag debug reset diag debug flow filter saddr <source IP address> diag debug flow filter dport 53 diag debug flow show console enable diag debug flow trace start 1000 diag debug en
NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
Hello,
This is what came back on the CLI
FGT60D4613031154 # id=13 trace_id=7 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:61368->192.168.210.1:53) from internal. " id=13 trace_id=7 func=init_ip_session_common line=4469 msg="allocate a new session-000001dd" id=13 trace_id=7 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=8 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:29156->192.168.210.1:53) from internal. " id=13 trace_id=8 func=init_ip_session_common line=4469 msg="allocate a new session-000001de" id=13 trace_id=8 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=9 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:61368->192.168.210.1:53) from internal. " id=13 trace_id=9 func=init_ip_session_common line=4469 msg="allocate a new session-000001df" id=13 trace_id=9 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=10 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:29156->192.168.210.1:53) from internal. " id=13 trace_id=10 func=init_ip_session_common line=4469 msg="allocate a new session-000001e0" id=13 trace_id=10 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=11 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:61368->192.168.210.1:53) from internal. " id=13 trace_id=11 func=init_ip_session_common line=4469 msg="allocate a new session-000001e1" id=13 trace_id=11 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=12 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:29156->192.168.210.1:53) from internal. " id=13 trace_id=12 func=init_ip_session_common line=4469 msg="allocate a new session-000001e2" id=13 trace_id=12 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=13 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:61368->192.168.210.1:53) from internal. " id=13 trace_id=13 func=init_ip_session_common line=4469 msg="allocate a new session-000001e3" id=13 trace_id=13 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=14 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:29156->192.168.210.1:53) from internal. " id=13 trace_id=14 func=init_ip_session_common line=4469 msg="allocate a new session-000001e4" id=13 trace_id=14 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=15 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:61368->192.168.210.1:53) from internal. " id=13 trace_id=15 func=init_ip_session_common line=4469 msg="allocate a new session-000001e7" id=13 trace_id=15 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop" id=13 trace_id=16 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=17, 192.168.210.5:29156->192.168.210.1:53) from internal. " id=13 trace_id=16 func=init_ip_session_common line=4469 msg="allocate a new session-000001e8" id=13 trace_id=16 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed on policy 0, drop"
Before I did the commands I verified that I could ping www.yahoo.com from the CLI and I could not successfully ping www.yahoo.com from the PC.
Thank You,
Joe
The FGT will not act as an DNS unless you instruct it to.
This needn't be so messy - just follow the 2 steps Fullmoon has already posted and then the FGT will respond to DNS requests. The debug clearly states that these requests are dropped, there's nobody listening on the FGT.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1634 | |
1063 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.