FortiGate DNS server

You can create local DNS servers for your network. Depending on your requirements, you can either manually maintain your entries (primary DNS server), or use it to refer to an outside source (secondary DNS server).

A local, primary DNS server requires that you to manually add all URL and IP address combinations. Using a primary DNS server for local services can minimize inbound and outbound traffic, and access time. Making it authoritative is not recommended, because IP addresses can change, and maintaining the list can become labor intensive.

A secondary DNS server refers to an alternate source to obtain URL and IP address combinations. This is useful when there is a primary DNS server where the entry list is maintained.

FortiGate as a DNS server also supports TLS connections to a DNS client. See DNS over TLS for details.

By default, DNS server options are not available in the FortiGate GUI.

To enable DNS server options in the GUI:

1. Go to System > Feature Visibility.
2. Enable DNS Database in the Additional Features section.
3. Click Apply.

Example configuration

This section describes how to create an unauthoritative primary DNS server. The interface mode is recursive so that, if the request cannot be fulfilled, the external DNS servers will be queried.

To configure FortiGate as a primary DNS server in the GUI:

1. Go to Network > DNS Servers.
2. In the DNS Database table, click Create New.
3. Set Type to Primary.
4. Set View to Shadow.

   The View setting controls the accessibility of the DNS server. If you select Public, external users can access or use the DNS server. If you select Shadow, only internal users can use it.

5. Enter a DNS Zone, for example, WebServer.
6. Enter the Domain Name of the zone, for example, fortinet.com.
7. Enter the Hostname of the DNS server, for example, Corporate.
8. Enter the Contact Email Address for the administrator, for example, admin@example.com.
9. Disable Authoritative.

   

10. Add DNS entries:
    1. In the DNS Entries table, click Create New.
    2. Select a Type, for example Address (A).
    3. Set the Hostname, for example web.example.com.

       

    4. Configure the remaining settings as needed. The options vary depending on the selected Type.
    5. Click OK.
11. Add more DNS entries as needed.
12. Click OK.
13. Enable DNS services on an interface:
    1. Go to Network > DNS Servers.
    2. In the DNS Service on Interface table, click Create New.
    3. Select the Interface for the DNS server, such as wan2.
    4. Set the Mode to Recursive.

       

    5. Click OK.

To configure FortiGate as a primary DNS server in the CLI:

config system dns-database
    edit WebServer
        set domain example.com
        set type master
        set view shadow
        set ttl 86400
        set primary-name corporate
        set contact admin@example.com
        set authoritative disable
        config dns-entry
            edit 1
                set hostname web.example.com
                set type A
                set ip 192.168.21.12
                set status enable
            next
        end
    next
end

config system dns-server
    edit wan1
        set mode recursive
    next
end