How to configure a LAN interface with DHCP disabled to use the ISP DNS server?

[fakecharle]

I have a Fortigate with a LAN interface with a static IP address (no DHCP enabled) which provides internet services to my internal network. The LAN interface is set up as a "DNS Service on Interface"  which forwards any host DNS queries to the system DNS. Therefore my host has been configured with the LAN interface IP address as the preferred DNS server address. However, in the Fortigate DNS page I cannot specify that I want to use system DNS and I am given just two options: Use FortiGuard Servers or Specify (which requires me to write down static IP addresses). I am using Fortiguard servers (i.e. primary and secondary DNS servers) but my WAN interface (which has both DHCP and Override internal DNS enabled) uses my ISP DNS server (i.e. Acquired DNS).

I want my LAN interface to use my ISP DNS server and acquire its address automatically as my WAN interface already does, but I am not sure what DNS server is being used to resolve my host DNS queries as the Fortigate has the Fortiguard servers configured as DNS servers but the wan interface is using the ISP DNS server. How may I know which DNS server is resolving my host DNS queries? If the Fortiguard servers are the ones making the resolution, how may I configure the LAN interface to use my ISP DNS server instead without having to enable DHCP?

[jintrah_FTNT]

Hi,

When you have Override internal DNS enabled on WAN interface, the dns servers received from ISP would be used and preferred over the one's defined for use in  Fortigate DNS page.

Best regards,

Jin

[fakecharle]

Thank you very much @jintrah_FTNT but is there a way for me to find this explicitly stated in the Fortigate settings or any command which can be run in my hosts machine to find out for sure? I mean, when I run nslookup in my host, I only get the IP address of the interface but when I run show system dns, I get shown the IP addresses of the Fortiguard servers. Besides, what would happen if I had my wan2 interface with Override internal DNS disabled? Which DNS servers would be used to resolve the DNS from the hosts in my internal network?

[Toshi_Esumi]

Probably you need to use "diag test application dnsproxy 3" to see what DNS server IPs the daemon has.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-Troubleshooting-DNS-commands/ta-...

Then I enabled override on Lumen circuit and then Comcast circuit next. The result was below. So the last one you enabled would come to the top. It seems.
fg40f-utm (global) # diag test application dnsproxy 3
worker idx: 0
VDOM: root, index=0, is primary, vdom dns is enabled, pip-0.0.0.0 dns_log=1
dns64 is disabled
DNS servers:
75.75.75.75:53 vrf=0 tz=0 encrypt=none req=0 to=0 res=0 rt=0 ready=1 timer=0 probe=0 failure=0 last_failed=0
75.75.76.76:53 vrf=0 tz=0 encrypt=none req=0 to=0 res=0 rt=0 ready=1 timer=0 probe=0 failure=0 last_failed=0
205.171.3.65:53 vrf=0 tz=0 encrypt=none req=0 to=0 res=0 rt=0 ready=1 timer=0 probe=0 failure=0 last_failed=0
205.171.2.65:53 vrf=0 tz=0 encrypt=none req=0 to=0 res=0 rt=0 ready=1 timer=0 probe=0 failure=0 last_failed=0
96.45.45.45:853 vrf=0 tz=0 encrypt=dot req=15 to=0 res=15 rt=2 ready=1 timer=0 probe=0 failure=0 last_failed=0
96.45.46.46:853 vrf=0 tz=0 encrypt=dot req=10 to=0 res=10 rt=2 ready=1 timer=0 probe=0 failure=0 last_failed=0
<snip>

To see actual DNS each query caused the FGT to asked to, you probably have to sniff UDP 53 traffic with like "diag sniffer packet any 'udp and port 53' 4 0"

Toshi