Managing TSIG Keys

Transaction SIGnature (TSIG) keys are used to authenticate DNS zone transfers and notifications. By requiring a shared secret, TSIG ensures that only authorized DNS servers can exchange zone data with FortiADC, protecting against unauthorized or spoofed transfer requests.

In FortiADC, TSIG keys are applied in zone transfer policies:

• Primary zones – TSIG keys authenticate transfer requests from secondary servers.

• Secondary zones – TSIG keys authenticate inbound transfers and NOTIFY messages from the upstream primary server.

FortiADC does not generate TSIG keys. Keys must be created externally (for example, with dnssec-keygen or another DNS management utility), saved as a plain-text key file, and then imported.

For details on applying TSIG keys in zones, see Configuring DNS zones.

To import a TSIG key:

1. Go to Global Load Balance > Zone Tools.
2. Click the TSIG Key tab.
3. Click Import.
4. Choose the TSIG key file to upload. The file must contain the key name, algorithm, and secret in the standard TSIG format (for example, .key files produced by BIND utilities).
5. Click Save.

Once imported, the TSIG key appears in the TSIG Key list. Key attributes (name, algorithm, secret) are read-only in FortiADC. If changes are required, you must delete the key and re-import a corrected version. These keys can then be referenced in zone configurations when defining transfer authentication.

TSIG Key Records

Each TSIG key record includes the following attributes:

Field	Description
Name	Unique identifier for the TSIG key within FortiADC.
Filename	The filename of the imported key.
Algorithm	The hashing algorithm used for signing messages (for example, HMAC-MD5, HMAC-SHA256).
Secret	The shared secret string imported from the key file.