New timers for FQDNs

On the FortiGate 6000 and 7000, you can use the following new options of the config system dns command to change two timers related to FQDNs used by FQDN firewall addresses. You may want to adjust these timers if you find that firewall policies with FQDN addresses aren't operating as expected. This can sometimes happen if FQDNs time out unexpectedly. These unexpected timeouts can also occur at different times on different FPCs or FPMs.

config system dns

set fqdn-cache-ttl <seconds>

set fqdn-min-refresh <seconds>

end

fqdn-cache-ttl set how long in seconds an FQDN's address record can live if not refreshed. This setting applies globally, across all VDOMs to FQDNs that have unspecified cache-ttl settings. You can still specify cache-ttl values for individual FQDNs when configuring a FQDN firewall address. Fortinet recommends setting fqdn-cache-ttl to 3600 seconds. Default value is 0 or no limit. The range is 0 to 86400 seconds.

fqdn-min-refresh set the lowest allowed FQDN refresh time in seconds. An FQDN cache cannot refresh at an interval shorter than this value. Using this setting, FQDNs that require fast resolutions can refresh at a faster rate without impacting other FQDNs that have longer TTL records. Default value is 60 seconds. The range is 10 to 3600 seconds.