Split DNS for Explicit Proxy

[jimmyt]

I have a Fortigate 600B that is used as a web proxy server. For name resolution the Fortigate uses one of our corporate DNS servers. It also has a small number of zones in its local DNS database. My issue is that now for one of the zones I require the Fortigate to look at its internal database for some entries but, if there are no specific host entries in the local zone, then do a lookup on our corporate DNS server. At the moment if the host entry is not found in the zone in its local DNS then the lookup bombs. I know that a split DNS configuration can be done for user DNS lookups but I can' t get this working for the lookups required by the explicit proxy. Any ideas?

[laf]

Thanks mate! Here is the current config: edit " ClassHQ" config dns-entry edit 1 set hostname " ns.class.local" set type NS next edit 2 set hostname " laf" set ip 172.20.20.15 next edit 3 set hostname " ns" set ip 172.20.20.1 next edit 4 set hostname " hyperv" set ip 172.20.20.13 next edit 5 set hostname " gns" set ip 172.20.20.14 next end set domain " class.local" set ttl 3600 next end For my 1st entry the hostname should be ns or ns.class.local? Do you know any logic reason for the lack of PTR records? Did you use/recommend FGT as local DNS server for 30-50 users? Or is it better to use an external public DNS server?

[ede_pfau]

a) hostname entries are always without domain names. b) logic? Nobody has asked for it, I guess. For 99% of all DNS queries this is not important. Who uses nslookup anyway? :-) c) a public DNS is not an alternative if I understand you correctly. I use the FGT DNS for my private hosts (and several managed hosts that are in remote subnets and which do not belong to me or my domain). For all other hosts the FGT DNS forwards the requests to my ISP' s DNS. See it as a central /etc/hosts file for local name resolution. For a company with 50 users I' d probably use a server based DNS, i.e. Windows Server 2003 DNS. Quite easy to set up and with full support. I know, I can hear the *nix gurus scream already, you could as well set up a DNS on a *nix box. If you don' t want that, and don' t want to distribute hosts files to all PCs then use the FGT DNS. It just works.

[laf]

Very nice explanation! Thanks again!

[ede_pfau]

Really? I haven' t found anything in the docs about this - Handbook, Release Notes, What' s New, CLI Guide: all I can find are the same record types as they had in 4.2.

[emnoc]

Interesting discussion, I think alot of this can be handle with a low memory/disk vmguest, and via using some type of " view" and forwarders statement DNS topology has always been a sore topic with today' s crops of Windoze and nix administrators.