Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
cskeller07
New Contributor

Web filter Vs. DNS filter

What is the difference?  Any pro's con's to one or the other?

 

Why would you need DNS filtering if you're already doing web filtering?

 

If you do not use the FortiGate as a DNS server does DNS filter do anything?

1 Solution
tititech
New Contributor

Here a practical example :

In my company, I can't use the dns filtering because of its requirement to use the fortiguard dns servers. We can't use external dns server.

with dns filtering you can't block access based on url. You blocked based on dns name resolution (ip address).

Let say for example, you want to block  seattle.org/ordering but allow seattle.org/pictures. Because both url resolve to the same ip address will not obtain the desired result with dns filtering. It will block access to seattle.org as a whole.

 

web filtering filters based on url and because you will be able to block seattle.org/ordering but allow seattle.org/pictures.

 

Ask yourself this question, what will happen if fortigate can't connect to FORTIGUARD DNS servers in the middle of the night?

What will happen to your policy rules? Does it go to allow or deny everything?

 

 

 

View solution in original post

11 REPLIES 11
Vanessa226

DNS Filter Concepts:

[ul]
  • With the release of FortiOS 5.4.0, users configure the Domain Name System (DNS) Filter security profile independent of the Web Filter security profile.[/ul]

    Web Filter Concepts:

    [ul]
  • Web filtering is a means of controlling the content that an Internet user is able to view. With the popularity of web applications, the need to monitor and control web access is becoming a key component of secure content management systems that employ antivirus, web filtering, and messaging security.[/ul]
  • Syed_Uzair_Ahmed
    New Contributor

    I have been using FGT2000 in my environment in explicit proxy mode. And I am unable to block malicious dns request. Is there any possibility that I can able to block and restrict malicious dns traffic on my firewall.

    Announcements

    Select Forum Responses to become Knowledge Articles!

    Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

    Labels
    Top Kudoed Authors