Windows DNS server behind Fortigate

[#1]

Hi guys, If someone can point me to the right direction, that would be really appreciated. What I am trying to achieve here is getting my Windows DNS server that is sitting behind Fortigate to perform name resolution for my website. Registered Website name: For this example I am using - mywebsite.com This is from Godaddy. My ISP has given me only 1 Public IP which I use as a VIP for load balancing webservers. i.e. 202.XX.XX.XX > Round robins either 192.168.1.44 or 192.168.1.45 At the moment, At GoDaddy, I have added an A record @ 202.XX.XX.XX (my Public VIP) so all the http requests come to my webservers and people can reach my website. However, I do not want to rely on Godaddy' s DNS and would like my own DNS server. For this I went to Godaddy' s panel and added my DNS server' s name under NS records. i.e. RESOLVE1.mywebsite.com However, this is not working. When I check this via dnsstuff.com, it reports the following: ns33.domaincontrol.com [216.69.185.17] 203.XX.XX.XX 30ms resolve1.mywebsite.com [0.0.0.0] Timeout If I refresh the page, it shows - ns33.domaincontrol.com [216.69.185.17] 203.XX.XX.XX 30ms resolve1.mywebsite.com [192.168.1.52] Timeout Here are my DNS and webserver settings: DNS Server IP config settings: IP 192.168.1.52 Mask 255.255.255.0 Gateway 192.168.1.1 (Fortigate) DNS 192.168.1.52 Fully qualified name: RESOLVE1.mywebsite.com WEB Server 1 IP config settings: IP 192.168.1.44 Mask 255.255.255.0 Gateway 192.168.1.1 (Fortigate) DNS 192.168.1.52 Fully qualified name: WEBSERVER1.mywebsite.com WEB Server 2 IP config settings: IP 192.168.1.45 Mask 255.255.255.0 Gateway 192.168.1.1 (Fortigate) DNS 192.168.1.52 Fully qualified name: WEBSERVER2.mywebsite.com Can some one please advise: Do I have to set up Port Forwarding on Fortigate? Do I have to configure any policy on Fortigate? Regards,

[#2]

@ 202.XX.XX.XX (my Public VIP) not 203.x.x.x...

Sorry about the typo. The correct VIP is 203.XX.XX.XX I have attached the conf firewall vip show

[#3]

(vip) # show config firewall vip edit " MYSQL" set comment " VIP for MYSQL" set type server-load-balance set extip 192.168.1.103 set extintf " internal" set server-type tcp set monitor " Health" set extport 3306 config realservers edit 1 set ip 192.168.1.102 set port 3306 next edit 2 set ip 192.168.1.101 set port 3306 next end next edit " VIP" set type server-load-balance set extip 203.XX.XX.XX set extintf " port4" set server-type http set monitor " HealthHTTP" set ldb-method round-robin set persistence http-cookie set extport 80 config realservers edit 1 set ip 192.168.1.45 set max-connections 40000 set port 80 next edit 2 set ip 192.168.1.46 set port 80 next end next edit " 192.168.1.50" set type server-load-balance set extip 192.168.1.50 set extintf " internal" set server-type ip next edit " DNS_VIP" set extip 203.XX.XX.XX set extintf " port4" set portforward enable set mappedip 192.168.1.52 set extport 53 set mappedport 53 next edit " DNS_VIP_UDP" set extip 203.XX.XX.XX set extintf " port4" set portforward enable set mappedip 192.168.1.52 set protocol udp set extport 53 set mappedport 53 next end

[#4]

(policy) # show config firewall policy edit 1 set srcintf " any" set dstintf " port4" set srcaddr " all" set dstaddr " all" set action accept set schedule " always" set service " HTTP" " HTTPS" " DNS" set logtraffic enable set nat enable next edit 2 set srcintf " internal" set dstintf " any" set srcaddr " all" set dstaddr " MYSQL" set action accept set schedule " always" set service " MYSQL" set logtraffic enable next edit 11 set srcintf " port4" set dstintf " internal" set srcaddr " all" set dstaddr " DNS_VIP" set action accept set schedule " always" set service " DNS" next edit 14 set srcintf " port4" set dstintf " internal" set srcaddr " all" set dstaddr " DNS_VIP_UDP" set action accept set schedule " always" set service " DNS" next edit 3 set srcintf " port4" set dstintf " internal" set srcaddr " all" set dstaddr " VIP" set action accept set schedule " always" set service " HTTP" next end

[#5]

Some additional information: When I ping resolve1.mywebsite.com from my workstation it returns: C:\Users\admin>ping resolve1.mywebsite.com Pinging resolve1.mywebsite.com [192.168.1.52] with 32 bytes of data: Reply from 192.168.1.52: bytes=32 time=1ms TTL=128 Reply from 192.168.1.52: bytes=32 time<1ms TTL=128 Reply from 192.168.1.52: bytes=32 time<1ms TTL=128 Reply from 192.168.1.52: bytes=32 time=2ms TTL=128 Regards,

[ede_pfau]

holy smokes...get your documentation CONSISTENT! this is tiresome so your web servers really are .45 and .46? good. policies and VIPs look OK. Some more hints where to debug: - make sure your DNS answers requests from all source addresses - how do you test your DNS? try nslookup, ENTER ' server 203.xx.xx.xx' web1 ... quit this uses DNS only (udp/53). - you use interface ' any' a lot. Try to avoid this if ever possible. Specify the interface you really mean to get a grip on your security. (though I don' t think this interferes with your DNS problem here.) So there are 2 possible reasons for not getting DNS replies: - your DNS server never sees the request - it does but you never see your server' s reply Of course you have the right default route set up on your DNS. Please check again. If all fails you' ll have to sniff the traffic to get answers.

[rwpatterson]

Here' s my question: Is the Windows server allowed to respond to external (non LAN) DNS queries?

[#8]

Hi all, Thanks to all. This issue has been resolved. I really wish there was a resolved button somewhere so people would take a note of this resolved post and this post would help someone in my situation. Special thanks to ede_pfau. I owe you a beer mate. Regards, Inder Lamba

[ede_pfau]

Never mind. It' s really the community here, we' re all working together as a team. I really think the Forums are special in a way. Professional, polite and personally at times. I' d be glad to have a beer or two with you if you send me a flight ticket. Or, if you just contribute with your experience and help others out in the future. I' m sure we won' t run out of questions anytime soon...