Which DNS Settings to use?

[seadave]

I' m running 4.3P15. Currently I have my DNS settings to my two AD DCs. My logs are filled with DNS lookups from the Fortigate. Looking over the manual, I saw this: DNS server addresses are configured by going to System > Network > DNS. Here you specify the DNS server addresses. Typically, these addresses are supplied by your ISP. An additional option is available if you have local Microsoft domains on the network, by entering a domain name in the Local Domain Name field. So I changed the settings to my ISPs DNS address and entered my internal company.local domain for " Local Domain Name" . Now on the dashboard, the Fortinet does not resolve any of the names of internal IPs. How do you configure the Forinet so that for example, WAN1 traffic is resolved by ISP DNS and LAN1 is resolved by internal DNS?

[Dave_Hall]

Not sure what would be the best practise in this case; my personal opinion would be to set up the Fortigate to use the internal DNS server IPs if you want it to resolve internal IP addresses, then set up the DNS services (on the AD DCs) to use your ISP' s DNS servers as " Forwarders" . If your WAN interface is configured via DHCP or PPPoE, you can force the fgt to use the DNS servers on that interface.

[netmin]

Use cases are specific and DNS settings are a bit more limited on the FGT, but here another test example: - the corporate domain is: " example.local" - the corporate network is 192.168.17.0/24 - the FGT is configured with ISP DNS servers - local (DHCP) clients are configured to use the FGT interface IP as DNS - the FGT LAN interface is set to do recursive DNS lookup - a local DNS-database is used on the FGT with 2 non-authoritative master zones - the FGT shall be able to override the internal DNS server (forwards and backwards) - as is done for test.example.local - all other internal lookups shall be forwarded to the internal DNS server - the internal DNS server in this example is 192.168.17.224 - lookups not related to the corporate network shall be forwarded to the ISP DNS

 config system dns-database
     edit " corp_forward" 
         set authoritative disable
             config dns-entry
                 edit 1
                     set hostname " test.example.local" 
                     set status enable
                     set ttl 0
                     set type A
                     set ip 192.168.17.234
                 next
             end
         set domain " example.local" 
         set forwarder " 192.168.17.224" 
         set source-ip 0.0.0.0
         set status enable
         set ttl 86400
         set type master
         set view shadow
         unset allow-transfer
         set contact " hostmaster" 
         set primary-name " dns" 
     next
     edit " corp_reverse" 
         set authoritative disable
             config dns-entry
                 edit 1
                     set hostname " test.example.local." 
                     set status enable
                     set ttl 0
                     set type PTR
                     set ip 192.168.17.234
                 next
             end
         set domain " 17.168.192.in-addr.arpa" 
         set forwarder " 192.168.17.224" 
         set source-ip 0.0.0.0
         set status enable
         set ttl 86400
         set type master
         set view shadow
         unset allow-transfer
         set contact " hostmaster" 
         set primary-name " dns" 
     next
 end
 

[ede_pfau]

One hint as I' ve had this scenario lately: customer runs a DC (Srv 2012R2) customer wants to have the DNS not on the AD but on the FGT So I set up a local DNS base like posted above by netmin. All is working OK. Then...customer boots Win 8.1 PC. PC doesn' t find the DC. It turns out that the DNS needs to have a SRV record. FortiOS doesn' t support records other than A, CNAME, NS, MX, PTR. So we set up a DNS on the DC with only one record, namely a SRV record to itself. Forwarding is done to the FGT, which in turn forwards to the ISP' s DNS. Which is a hack. If anyone knows a smarter design I' d be grateful to get to know it.

[baitken]

Active Directory requires functional DNS services in order to work properly, so all of your internal clients should use the DC as DNS server. If you don' t want your DC making DNS queries to the internet, you should configure the forwarder in the properties of the DNS server to be the FG. On the FG (5.2.0) ensure the DNS Database feature is enabled in System -> Config -> Features, then in System -> Network -> DNS Servers create a service for the internal interface.

[Ub3rus]

Is there a way to block the resolution of DNS records of some zones in local DNS Database for recursive DNS servers running on specific interfaces?

For example, I have local zone on FortiGate which forwards lookups of internal corporate domain to internal DNS servers (As in your example.local example). I have wifi guests on isolated subnet using their local interface on fortigate as recursive DNS server. But I don't want them to be able to resolve internal corporate domain (security reasons). I want them to be able to resolve only some of the other zones I set up on the FortiGate and of course to resolve all public DNS records on the Internet.