Troubleshooting for DNS filter

If you have trouble with the DNS filter profile in your policy, start with the following troubleshooting steps:

• Check the connection between the FortiGate and FortiGuard DNS rating server (SDNS server).
• Check that the FortiGate has a valid FortiGuard web filter license.
• Check the FortiGate DNS filter configuration.

Checking the connection between the FortiGate and FortiGuard SDNS server

You need to ensure the FortiGate can connect to the FortiGuard SDNS server. By default, the FortiGate uses UDP port 53 to connect to the SDNS server.

To check the connection between the FortiGate and SDNS server:

1. Verify the FortiGuard SDNS server information:

   # diagnose test application dnsproxy 3
   ...
   FDG_SERVER:208.91.112.220:53
   FGD_CATEGORY_VERSION:8
   SERVER_LDB: gid=6f00, tz=-420, error_allow=0
   FGD_REDIR:208.91.112.55

   The SDNS server IP address might be different depending on location (in this example, it is 208.91.112.220:53).

2. In the management VDOM, check the communication between the FortiGate and the SDNS server:

   #execute ping 208.91.112.220

3. Optionally, you can check the communication using a PC on the internal network (this example uses dig).
   1. Disable the DNS filter profile so that it does not affect your connection check.
   2. Ping your ISP or a public DNS service provider's DNS server, for example, Google's public DNS server of 8.8.8.8:

      #dig @8.8.8.8 www.fortinet.com
      

      Or, specify the SDNS server as a DNS server:

      #dig @208.91.112.220 www.fortinet.com

   3. Verify that you can get a domain www.fortinet.com A record from the DNS server. This shows that the UDP port 53 connection path is not blocked.

      #dig @8.8.8.8 www.fortinet.com
      ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 35121
      ;; Flags: qr rd ra; QUERY: 1; ANSWER: 3; AUTHORITY: 0; ADDITIONAL: 0
      
      ;; QUESTION SECTION:
      ;; www.fortinet.com.            IN      A
      
      ;; ANSWER SECTION:
      www.fortinet.com.       289     IN      CNAME   fortinet-prod4-858839915.us-west-1.elb.amazonaws.com.
      fortinet-prod4-858839915.us-west-1.elb.amazonaws.com. 51        IN      A       52.8.142.247
      fortinet-prod4-858839915.us-west-1.elb.amazonaws.com. 51        IN      A       13.56.55.78
      
      ;; Received 129 B
      ;; Time 2019-04-29 14:13:18 PDT
      ;; From 8.8.8.8@53(UDP) in 13.2 ms

Checking the FortiGuard DNS rating service license

The FortiGuard DNS rating service shares the license with the FortiGuard web filter, so you must have a valid web filter license for the DNS rating service to work. While the license is shared, the DNS rating service uses a separate connection mechanism from the web filter rating.

To check the DNS rating service license in the CLI:

1. View the DNS settings:

   # diagnose test application dnsproxy 3

2. Look for the FGD_DNS_SERVICE_LICENSE line and check that the license has not expired:

   FGD_DNS_SERVICE_LICENSE:
   server=208.91.112.220:53, expiry=2022-10-03, expired=0, type=2

3. Check the dns-server lines. Some dns-server lines show secure=1 ready=1. These lines show the functioning servers:

   dns-server:208.91.112.220:53 tz=-480 req=7 to=0 res=7 rt=1 secure=1 ready=1 timer=0 probe=0 failure=0 last_failed=0

Checking the FortiGate DNS filter profile configuration

To check the DNS filter profile configuration:

1. In FortiOS, create a local domain filter and set the Action to Redirect to Block Portal (see Local domain filter).
2. Apply this DNS filter profile to the policy.
3. From the client PC, perform a DNS query on this domain. If you get the profile's redirected portal address, this means that the DNS filter profile works as expected.

Additional troubleshooting

Use diagnose test application dnsproxy <test level> to troubleshoot further DNS proxy information, where:

Test level	Action
1	Clear DNS cache
2	Show statistics
3	Dump DNS setting
4	Reload FQDN
5	Requery FQDN
6	Dump FQDN
7	Dump DNS cache
8	Dump DNS database
9	Reload DNS database
10	Dump secure DNS policy/profile
11	Dump botnet domain
12	Reload secure DNS setting
13	Show hostname cache
14	Clear hostname cache
15	Show SDNS rating cache
16	Clear SDNS rating cache
17	Show DNS debug bit mask
18	Show DNS debug object members
99	Restart the dnsproxy worker

To debug DNS proxy details:

#diagnose debug application dnsproxy -1
#diagnose debug {enable | disable}