fortiview website monitor is not resolving the IPS into the domain names- FORTIWIFI 40F

[antoniocerasuolo]

Hi,

for some strange reason:

1) the fortiview website monitor is not resolving the IPs into the relative domain name

2) I am only able to view for "now" all other options don't work ( 1hr, 24 hrs, etc..)

looking around I have created my local DNS servers in thinking that I needed a reverse lookup?

therefore I created 2 local DNS using 8.8.8.8 and 8.8.4.4 with " A" records and I created also 2 "PTR" records off of each IP.  therefore I have 4 records. 

question 1: is it correct to use google IPs for my local DNS?

question 2: is it correct to use the relative "PTR" records?

question 3: seems none of this is working to get me the domain names in the fortiview website monitor therefore something is wrong.

thank you

[AEK]

Hello Antonio

As far as I know, FG doesn't show the domain names unless it sees the DNS resolution that was done by the client for that site.

So in case you client is using DNS over HTTPS or over SSL and the FG doesn't use deep inspection for the related DNS policy, then FG doesn't see which domain name is requested by the client.

Reverse lookup will not help. And I think using 8.8.8.8 & 8.8.4.4 as local addresses is not a clean solution.

You may try one of the following and it should work.

• Force user to do DNS resolution from FG (and deny DNS requests from clients to any other destination)
• Or force them to do DNS resolution from other local DNS server via legacy unencrypted method
• Or enable deep inspection to read encrypted DNS queries and responses (I didn't try it but it should work as well)

Hope it helps.

[antoniocerasuolo]

hi AEK,

can you please outline the steps to undertake in each one of those bullet points?? because as is it's not very clear how to put into concrete action what you sugget.

ciao,
Antonio

[AEK]

Let's implement the second example:

1. Setup your local DNS server
2. Configure all your client to do DNS resolution from your local DNS server (e.g.: set it via DHCP)
3. On your FG, create a firewall rule to allow DNS traffic from clients to local DNS server
4. On your FG, deny any other encrypted DNS traffic from clients to anywhere. You can do this with application profile, under Application and Filter Override, then block DNS.Over.HTTPS and DNS.Over.TLS

[antoniocerasuolo]

hi AEK,

thank you!!!!

in truth I have started toi actually look at the logs on the forticloud and I have purchased the fortianalyzer cloud license as well so waiting to implement that sometime nexrt week!

that being said of the points above , points 1 & 2 are clear!  points 3 & 4 are not clear how to atually do that on a step by step basis?

don't want to bug you, if you can outline those I would appreciate it, but understand if you don't have the time!

ciao,
Antonio

[AEK]

Hi Antonio

3. On your FG, create a firewall rule to allow DNS traffic from clients to local DNS server

• On FG, go to Policy & Object > Firewall Policy, add a new policy with the below values:
  • Src intf: Client interface (or VLAN)
  • Dst intf: DNS server interface (or VLAN)
  • Src: Client IP range
  • Dst: DNS server IP
  • Service: DNS
  • Action: Accept

4. On your FG, deny any other encrypted DNS traffic from clients to anywhere. You can do this with application profile, under Application and Filter Override, then block DNS.Over.HTTPS and DNS.Over.TLS

• On FG, go to Security Profiles > Application Control, and edit the app profile that you are using for your clients' traffic towards internet, as follows:
  
  • Under section "Application and Filter Overrides", click Create New
  • Select application "DNS.Over.HTTPS", and action "Block", then validate
  • Click again Create New, then do the same with "DNS.Over.TLS" app
• As mentioned, this assumes the above app profile is used in firewall policy(ies) that is filtering clients' traffic to internet. But in case you are not using an application profile in the policy

Hope it helps.

[antoniocerasuolo]

i hope you read this.. the policy is not working .. not sure what is the problem.

i det src interface as internal and dest interface as internal also.. that may not be correct maybe should put WAN?

i sent the DNS server as a range as its inmpossible to set a single IP ?

ciao,
Antonio

[antoniocerasuolo]

i put the range of the DNS server as 192.168.1.254-192.168.1.254 as it is impossible to to put a single IP in the policy. unless i'm missing something.

but the biggest issue is what is the dest interface? WAn  or internal?

[antoniocerasuolo]

I seem to be unabel to post relies