WiFi VLAN Clients on DMZ can't resolve DNS inquires to local LAN

[l0gan]

Hello,

Currently have Merkai AP's that route clients on VLAN1001 to the Gate. Subnet is 172.16.2.X. This interface sits in a DMZ, so I made a policy: From>DMZ, To>Inside, Source>VLAN1001, Destination> VLANx(Internal Servers), Service>ALL, NAT>Enabled

I am able to ping and RDP via IP (10.100.1.X) to said VLANx that hosts our servers so I know that it is working, but when trying to resolve host names or RDP via hosts, the DNS queries fail. The DNS server is hosted on the VLANx, where I have my policy pointing to. I have made VLAN1001 Recursive in the DNS Service on the gate itself, as well as pointing the VLAN1001 interface directly to the DNS server instead of choosing same as sys/inter options. 

Could anyone give me a pointer to possible help walk me through the small step that I am missing? 

Thank you all so much ahead of time for you assistance and patience 

[Anonymous]

Hello @l0gan,

                   Thanks for reaching Fortinet Community. Could you confirm the following?

- The policy in the firewall that allows the traffic to DNS server, does it allow all services apart from ICMP and RDP. Meaning does the policy allow DNS traffic?

- If yes, can you see if that policy records the logs and if you can verify any traffic is being blocked by the firewall?

Hope to hear back from you soon.

Thanks and regards,

[l0gan]

Hello Aashiq, thank you for your reply!

I have gone ahead and confirmed the following:

The firewall policy does allow ALL services  (double checked the policy). I just noticed that in the policy, NAT was unchecked. I went fixed that policy, enabled what I needed and my wifi subnet is now resolving the inquires! 

Apologies for taking up your time but I appreciate your response and helping me.