DNS Split: resolve internal and external names local on the fortigate on different servers?
this request regards to DNS name resolution on the fortigate local only!
The configuration of the firewall was changed to per-VDOM dns, because FQDN objects in that vdom should be resolved by an external nameserver. But unfortunately this leads to problems with the resolution of configured firewall users. The fortigate needs to resolve names for the following purposes:
1. Names of local configured servers (LDAP, RADIUS, etc)
Yes, actually this works. I built this in a lab and did packet captures. The Fortigate is always asking both, the primary and secondary, regardless which domain is asked, and it will get an answer of one of both servers. But with this configuration I would loose the redundancy of the namservers. Means, if the primary fails, resolution of internal names would fail. Even if this works, I cannot implement this in our productive network.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.