Technical Tip: How to update IP address with FortiGuard DDNS service and upstream router

[ighita]

Description

This article describes how to update the public IP address when a upstream router is being used. An example configuration for FortiGuard DDNS service is provided.

Scope

FortiGate (FortiOS) updates the IP address on the FortiGuard DDNS server when it detects a change on a monitored interface. For example, a new lease from DHCP, PPPoE, an interface flap, etc.

Consider this network diagram:

Internet === (upstream router) === [wan1](FortiGate)[internal1] === LAN

The above includes:

• An upstream router with PPPoE and public IP.
• A FortiGate with a private IP at the wan1 interface.

DDNS configuration in this setup:

config system ddns

    edit 1

        set ddns-server FortiGuardDDNS

        set ddns-domain "fg.fortiddns.com"

        set use-public-ip enable

        set monitor-interface "wan1"

    next

end

How it works:

• DDNS monitors the wan1 interface.
• With an unstable ISP line, the public IP on the upstream router can change, but FortiGate is not aware of this change. The connection on FortiGate’s wan1 interface is stable and without any change.
• As a result, the public IP in the FortiGuard DDNS service is not updated.

Solution

The following solutions can be deployed to use DDNS with this scenario:

Solution 1(All versions):

Use the DDNS service on the upstream router with another DDNS service provider. The instability or changes on the ISP line will trigger changes on the upstream router.

Solution 2 (FortiOS 5.6, 6.0 and 6.2):

With FortiOS 5.6, a new 'update-interval' option has been introduced to periodically update the FortiGuard DDNS service with the proper IP address. By default, the value is set to 300 seconds.

Configuration with versions 5.6, 6.0, and 6.2:

config system ddns

    edit 1

       set ddns-server FortiGuardDDNS

       set ddns-domain "fg.fortiddns.com"

       set use-public-ip enable

       set monitor-interface "wan1"

       set update-interval 300

    next

end

Solution 2 (FortiOS 5.4):

FortiOS version 5.4 does not have an 'update-interval' option. Regardless, the following workaround can be used.

Configure the following:

• A link-monitor option over the wan1 interface.
• On link failover, flap another physical interface.
• The flapped interface is monitored by DDNS.

The final workaround configuration:

config system ddns

    edit 1

       set ddns-server FortiGuardDDNS

       set ddns-domain "fg.fortiddns.com"

       set use-public-ip enable

       set monitor-interface "internal1"

    next

end

config system interface

    edit wan1

       set fail-detect enable

       set fail-detect-option detectserver

       set fail-alert-interfaces "internal1"

    next

end

config system link-monitor

    edit isp

       set srcintf “wan1”

       set server “x.x.x.x” “y.y.y.y”

    next

end

How it works:

• Link-monitor monitors the ISP line over the wan1 interface.
• When the ISP line is down, link-monitor detects the failure and flaps the internal1 interface.
• The internal1 interface is monitored by the DDNS process.
• When the internal1 interface flaps, the DDNS process updates the IP address in the FortiGuard DDNS service.

Note: The 'use-public-ip' option is only available when using 'FortiGuardDDNS' as the DDNS server.