Websites blocking on Android

[Bock]

Hello, I am having a problem with Fortigate.

It seems like some websites are being blocked only on Android, when I use a laptop or Ios everything is working fine. When I try to see the logs I can't see that a website is being blocked.

I would apprentice any help.

[sw2090]

Do you have AppControl active on your internet policies? Then the App Signatures may cause that...

[Bock]

Thanks for the reply. Yes AppControl is active. By going on Chrome settings and changing the Use Secure DNS to Google (Public DNS) instead of current service DNS the websites that were being blocked are working.

Is it possible to fix this issue from Fortigate please? Instead of having to change the Secure DNS from Chrome. Thank you.

[Bock]

On Fortigate by switching off TLS and switching on DNS from DNS settings solved the issue. I am not sure if this will effect other things.

[abarushka]

Hello,

Can you please elaborate what you are referring to by switch off TLS on FortiGate side?

[Bock]

Hello, I used the setting below. Before only TLS was switched on.

[pbangari]

Hi,

Please help us with DNS packet captures to see what is happening when you use TLS protocol for DNS service.

# diag sniffer packet any "(host <Android user IP address> or host <public IP address on the FGT) and port 853" 6 0 a   ---------------ctrl+c to stop the pcap

Fortigate

[kaman]

As you informed after switching on DNS (UDP/53) from DNS settings you are able to access the website.

DNS primarily uses the UDP protocol on port 53 to serve the address resolve requests.

The FortiGate DNS Filter inspects the UDP protocol on port 53 traffic that traverse FortiGate, and based on the DNS Filter profile configuration, makes the Allow/Monitor/Block or Redirect decision for the inspected traffic.

DNS over TLS (DoT) is a security protocol for encrypting and encapsulating DNS queries and responses over the TLS protocol. DoT increases user privacy and security by preventing eavesdropping and manipulation of DNS data via man-in-the-middle attacks.

Before enabling DoT or DoH, ensure that they are supported by the DNS servers. The legacy FortiGuard DNS servers (208.91.112.53 and 208.91.112.52) do not support DoT or DoH queries, and will drop these packets. Disabling DoT and DoH is recommended when they are not supported by the DNS servers.

Please refer to the below documents for more understanding:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Changing-nbsp-the-nbsp-DNS-nbsp-protocol-n...
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/42181/dns-over-tls-and-https....