How to configure a LAN interface with DHCP disabled to use the ISP DNS server?

[fakecharle]

I have a Fortigate with a LAN interface with a static IP address (no DHCP enabled) which provides internet services to my internal network. The LAN interface is set up as a "DNS Service on Interface"  which forwards any host DNS queries to the system DNS. Therefore my host has been configured with the LAN interface IP address as the preferred DNS server address. However, in the Fortigate DNS page I cannot specify that I want to use system DNS and I am given just two options: Use FortiGuard Servers or Specify (which requires me to write down static IP addresses). I am using Fortiguard servers (i.e. primary and secondary DNS servers) but my WAN interface (which has both DHCP and Override internal DNS enabled) uses my ISP DNS server (i.e. Acquired DNS).

I want my LAN interface to use my ISP DNS server and acquire its address automatically as my WAN interface already does, but I am not sure what DNS server is being used to resolve my host DNS queries as the Fortigate has the Fortiguard servers configured as DNS servers but the wan interface is using the ISP DNS server. How may I know which DNS server is resolving my host DNS queries? If the Fortiguard servers are the ones making the resolution, how may I configure the LAN interface to use my ISP DNS server instead without having to enable DHCP?

[jintrah_FTNT]

Hi,

When you have Override internal DNS enabled on WAN interface, the dns servers received from ISP would be used and preferred over the one's defined for use in  Fortigate DNS page.

Best regards,

Jin

[fakecharle]

Thank you very much @jintrah_FTNT but is there a way for me to find this explicitly stated in the Fortigate settings or any command which can be run in my hosts machine to find out for sure? I mean, when I run nslookup in my host, I only get the IP address of the interface but when I run show system dns, I get shown the IP addresses of the Fortiguard servers. Besides, what would happen if I had my wan2 interface with Override internal DNS disabled? Which DNS servers would be used to resolve the DNS from the hosts in my internal network?

[Toshi_Esumi · Accepted solution]

Probably you need to use "diag test application dnsproxy 3" to see what DNS server IPs the daemon has.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-Troubleshooting-DNS-commands/ta-...

Then I enabled override on Lumen circuit and then Comcast circuit next. The result was below. So the last one you enabled would come to the top. It seems.
fg40f-utm (global) # diag test application dnsproxy 3
worker idx: 0
VDOM: root, index=0, is primary, vdom dns is enabled, pip-0.0.0.0 dns_log=1
dns64 is disabled
DNS servers:
75.75.75.75:53 vrf=0 tz=0 encrypt=none req=0 to=0 res=0 rt=0 ready=1 timer=0 probe=0 failure=0 last_failed=0
75.75.76.76:53 vrf=0 tz=0 encrypt=none req=0 to=0 res=0 rt=0 ready=1 timer=0 probe=0 failure=0 last_failed=0
205.171.3.65:53 vrf=0 tz=0 encrypt=none req=0 to=0 res=0 rt=0 ready=1 timer=0 probe=0 failure=0 last_failed=0
205.171.2.65:53 vrf=0 tz=0 encrypt=none req=0 to=0 res=0 rt=0 ready=1 timer=0 probe=0 failure=0 last_failed=0
96.45.45.45:853 vrf=0 tz=0 encrypt=dot req=15 to=0 res=15 rt=2 ready=1 timer=0 probe=0 failure=0 last_failed=0
96.45.46.46:853 vrf=0 tz=0 encrypt=dot req=10 to=0 res=10 rt=2 ready=1 timer=0 probe=0 failure=0 last_failed=0
<snip>

To see actual DNS each query caused the FGT to asked to, you probably have to sniff UDP 53 traffic with like "diag sniffer packet any 'udp and port 53' 4 0"

Toshi

[fakecharle]

Hi @Toshi_Esumi thank you very much for your reply. My ISO DNS server does show up indeed as the first entry but how may I succesffuly capture the traffic to be sure that is the server being used? I have used Wireshark on my client device and captured the traffic as it made a DNS query until it got a response but the traffic does not reveal which DNS resolvers are being used. Only the client and the DnS-enabled Fortigate interface are shown as source and destination, respectively. 

[Toshi_Esumi]

That's why I wrote
    diag sniffer packet any 'udp and port 53' 4 0
in the last post. Run it in CLI.

Toshi

[fakecharle]

Thank you very much @Toshi_Esumi!  When you mentioned the command diag sniffer packet, I thought you meant to use Wireshark to capture traffic (which I tried form my client device but did not reveal anything) as I wasn't aware FortiOS was capable of sniffing packets. In my case, I didn't have to deal with Lumen and Comcast circuits, I only used diag test dns proxy 3 to see the configured DNS servers and diag sniffer packet wan1 'port 53' 3. Does Lumen and Comcast offer more insight? If so how are they to be configured? I really aopreciate your help and all of those who made a comment as well. Thank you very much!

[Toshi_Esumi]

Lumen and Comcast are just my circuit providers, just providing their DNS server IPs over PPPoE and DHCP respectively. They have nothing to do with my FGT's decision what DNS IP to be used for DNS query from the FGT, or recursive query originated by the devices behind it.

Toshi