Internet Access to computers on a Domain Environment

[k_stein]

Hello All,

Hope you have a nice day,

My Question here is:

We a have a domain environment and the DC act as a primary DNS server and a FG100E on on the network, we need computers to have access to the internet, by default the computers have the internal (Domain) DNS set on their NIC, how to point them to 8.8.8.8 to be able to resolve external addresses, should I use my DC as a DNS forwarder? or can I use the FG100E somehow to forward the traffic to an External DNS and return it to the computers, We don't want to set the secondary DNS on pc to 8.8.8.8 cuz it makes problem with Active directory resolving, what is the best practice for this please ?

[GDiFi]

Domain machines should point to the internal DNS server.  If it is not setup already, it is a good idea to have that server handle the external DNS resolution through a forwarder as well. 

If the fortigate sits between the client and the internal DNS server, you can also use the DNS filter security services to help filter out requests for site you do not want them to reach.