Fortigate - Shorten TTL for FQDN Address

[johnycoms]

Hi

Fortigate 101F

Version 7.6.0

I'm trying to reduce the TTL for a number of fqdn addresses by setting the cache-ttl on the address object itself.

When the default cache-ttl is set to 0, and also the global setting for fqdn-cache-ttl is set to 0, it is using 2400 seconds - which I assume is from the DNS query response. (The Fortigate is configured to use our DCs for DNS)
. 

To overcome this, I have set the cache-ttl to 60 under the FQDN type address object, but it continues to use the 2400 timer?.

I am checking this by using command - diag test app dnsproxy 6 

Any help much appreciated

FortiGate 

[salemneaz]

Hi,

Did you get a change to check this article;

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Explanation-of-the-FQDN-nbsp-default-nbsp-...

Did you tried this setting;

config system dns
set fqdn-cache-ttl 2000
end

Or this one;

config firewall address
edit "FQDN_s3-fips.us-gov-west-1.amazonaws.com/"
set type fqdn
set fqdn "s3-fips.us-gov-west-1.amazonaws.com"
set cache-ttl 86400 <----- Default value is 0.
next

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-deal-with-FQDN-with-short-DNS-TTL/t...

What is the Firmware version