Fortinac Check Dns

[rcpdkc]

Hello, how can I quarantine the user's DNS address in fortinac if it is an address other than the DNS address I specified?

[AEK]

Hello

I'm not sure to understand what you mean by user's DNS,

but here is how you can quarantine a USER:

• Go to menu Users & Hosts > Hosts
• Right-click on the user(s)
• Click the Disable Users sub menu

On the other hand you can quarantine a HOST this way:

• Users & Hosts > Hosts
• Right-click the host(s)
• Click the Disable sub-menu

Once you do that, the disabled host should go to dead-end/isolation, and any host that the user logs-on will go to dead-end/isolation.

[rcpdkc]

 When Windows changes the DNS manually and this DNS address is not the one I specified 

[ndumaj]

Hello,

well it depends, you can also manually disable that host via host view list or what I can suggest is to use Persistent agent and add custom scan for domain joined users.
https://docs.fortinet.com/document/fortinac/9.4.0/administration-guide/156414/endpoint-compliance

BR

[ebilcari]

If I understood this correctly, you want to disable port/host in case it uses a DNS other than specified. Since this is not a static configuration value (checked via registry, processes) it can't be identified by the agent scans. It's better to use the Firewall to report this behavior as an incident and than map it to an Action in FNAC to disable the host or mark it as at risk.

[rcpdkc]

I tried to check with registry but can't because it matches another value

[AEK]

I fully agree with @ebilcari , the solution is to detect the traffic at firewall level and to send the event to NAC so it isolates the client.

[rcpdkc]

I don't quite understand how to do this

[ebilcari]

You can check this video on Fortinet Video Library for more details.

[rcpdkc]

I don't have this menu, is it licence related?