Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

CLI Reference

config dnsfilter profile

Configure DNS domain filter profiles.

config dnsfilter profile

Description: Configure DNS domain filter profiles.

edit <name>

set comment {var-string}

config domain-filter

Description: Domain filter settings.

set domain-filter-table {integer}

end

config ftgd-dns

Description: FortiGuard DNS Filter settings.

set options {option1}, {option2}, ...

config filters

Description: FortiGuard DNS domain filters.

edit <id>

set category {integer}

set action [block|monitor]

set log [enable|disable]

next

end

end

set log-all-domain [enable|disable]

set sdns-ftgd-err-log [enable|disable]

set sdns-domain-log [enable|disable]

set block-action [block|redirect]

set redirect-portal {ipv4-address}

set redirect-portal6 {ipv6-address}

set block-botnet [disable|enable]

set safe-search [disable|enable]

set youtube-restrict [strict|moderate]

set external-ip-blocklist <name1>, <name2>, ...

config dns-translation

Description: DNS translation settings.

edit <id>

set addr-type [ipv4|ipv6]

set src {ipv4-address}

set dst {ipv4-address}

set netmask {ipv4-netmask}

set status [enable|disable]

set src6 {ipv6-address}

set dst6 {ipv6-address}

set prefix {integer}

next

end

next

end

config dnsfilter profile

Parameter

Description

Type

Size

Default

comment

Comment.

var-string

Maximum length: 255

log-all-domain

Enable/disable logging of all domains visited (detailed DNS logging).

option

-

disable

 

Option

Description

enable

Enable logging of all domains visited.

disable

Disable logging of all domains visited.

sdns-ftgd-err-log

Enable/disable FortiGuard SDNS rating error logging.

option

-

enable

 

Option

Description

enable

Enable FortiGuard SDNS rating error logging.

disable

Disable FortiGuard SDNS rating error logging.

sdns-domain-log

Enable/disable domain filtering and botnet domain logging.

option

-

enable

 

Option

Description

enable

Enable domain filtering and botnet domain logging.

disable

Disable domain filtering and botnet domain logging.

block-action

Action to take for blocked domains.

option

-

redirect

 

Option

Description

block

Return NXDOMAIN for blocked domains.

redirect

Redirect blocked domains to SDNS portal.

redirect-portal

IPv4 address of the SDNS redirect portal.

ipv4-address

Not Specified

0.0.0.0

redirect-portal6

IPv6 address of the SDNS redirect portal.

ipv6-address

Not Specified

::

block-botnet

Enable/disable blocking botnet C&C DNS lookups.

option

-

disable

 

Option

Description

disable

Disable blocking botnet C&C DNS lookups.

enable

Enable blocking botnet C&C DNS lookups.

safe-search

Enable/disable Google, Bing, and YouTube safe search.

option

-

disable

 

Option

Description

disable

Disable Google, Bing, and YouTube safe search.

enable

Enable Google, Bing, and YouTube safe search.

youtube-restrict

Set safe search for YouTube restriction level.

option

-

strict

 

Option

Description

strict

Enable strict safe seach for YouTube.

moderate

Enable moderate safe search for YouTube.

external-ip-blocklist <name>

One or more external IP block lists.

External domain block list name.

string

Maximum length: 79

config domain-filter

Parameter

Description

Type

Size

Default

domain-filter-table

DNS domain filter table ID.

integer

Minimum value: 0 Maximum value: 4294967295

0

config ftgd-dns

Parameter

Description

Type

Size

Default

options

FortiGuard DNS filter options.

option

-

 

Option

Description

error-allow

Allow all domains when FortiGuard DNS servers fail.

ftgd-disable

Disable FortiGuard DNS domain rating.

config filters

Parameter

Description

Type

Size

Default

category

Category number.

integer

Minimum value: 0 Maximum value: 255

0

action

Action to take for DNS requests matching the category.

option

-

monitor

 

Option

Description

block

Block DNS requests matching the category.

monitor

Allow DNS requests matching the category and log the result.

log

Enable/disable DNS filter logging for this DNS profile.

option

-

enable

 

Option

Description

enable

Enable DNS filter logging.

disable

Disable DNS filter logging.

config dns-translation

Parameter

Description

Type

Size

Default

addr-type

DNS translation type (IPv4 or IPv6).

option

-

ipv4

 

Option

Description

ipv4

IPv4 address type.

ipv6

IPv6 address type.

src

IPv4 address or subnet on the internal network to compare with the resolved address in DNS query replies. If the resolved address matches, the resolved address is substituted with dst.

ipv4-address

Not Specified

0.0.0.0

dst

IPv4 address or subnet on the external network to substitute for the resolved address in DNS query replies. Can be single IP address or subnet on the external network, but number of addresses must equal number of mapped IP addresses in src.

ipv4-address

Not Specified

0.0.0.0

netmask

If src and dst are subnets rather than single IP addresses, enter the netmask for both src and dst.

ipv4-netmask

Not Specified

255.255.255.255

status

Enable/disable this DNS translation entry.

option

-

enable

 

Option

Description

enable

Enable this DNS translation.

disable

Disable this DNS translation.

src6

IPv6 address or subnet on the internal network to compare with the resolved address in DNS query replies. If the resolved address matches, the resolved address is substituted with dst6.

ipv6-address

Not Specified

::

dst6

IPv6 address or subnet on the external network to substitute for the resolved address in DNS query replies. Can be single IP address or subnet on the external network, but number of addresses must equal number of mapped IP addresses in src6.

ipv6-address

Not Specified

::

prefix

If src6 and dst6 are subnets rather than single IP addresses, enter the prefix for both src6 and dst6 (1 - 128, default = 128).

integer

Minimum value: 1 Maximum value: 128

128

config dnsfilter profile

Configure DNS domain filter profiles.

config dnsfilter profile

Description: Configure DNS domain filter profiles.

edit <name>

set comment {var-string}

config domain-filter

Description: Domain filter settings.

set domain-filter-table {integer}

end

config ftgd-dns

Description: FortiGuard DNS Filter settings.

set options {option1}, {option2}, ...

config filters

Description: FortiGuard DNS domain filters.

edit <id>

set category {integer}

set action [block|monitor]

set log [enable|disable]

next

end

end

set log-all-domain [enable|disable]

set sdns-ftgd-err-log [enable|disable]

set sdns-domain-log [enable|disable]

set block-action [block|redirect]

set redirect-portal {ipv4-address}

set redirect-portal6 {ipv6-address}

set block-botnet [disable|enable]

set safe-search [disable|enable]

set youtube-restrict [strict|moderate]

set external-ip-blocklist <name1>, <name2>, ...

config dns-translation

Description: DNS translation settings.

edit <id>

set addr-type [ipv4|ipv6]

set src {ipv4-address}

set dst {ipv4-address}

set netmask {ipv4-netmask}

set status [enable|disable]

set src6 {ipv6-address}

set dst6 {ipv6-address}

set prefix {integer}

next

end

next

end

config dnsfilter profile

Parameter

Description

Type

Size

Default

comment

Comment.

var-string

Maximum length: 255

log-all-domain

Enable/disable logging of all domains visited (detailed DNS logging).

option

-

disable

 

Option

Description

enable

Enable logging of all domains visited.

disable

Disable logging of all domains visited.

sdns-ftgd-err-log

Enable/disable FortiGuard SDNS rating error logging.

option

-

enable

 

Option

Description

enable

Enable FortiGuard SDNS rating error logging.

disable

Disable FortiGuard SDNS rating error logging.

sdns-domain-log

Enable/disable domain filtering and botnet domain logging.

option

-

enable

 

Option

Description

enable

Enable domain filtering and botnet domain logging.

disable

Disable domain filtering and botnet domain logging.

block-action

Action to take for blocked domains.

option

-

redirect

 

Option

Description

block

Return NXDOMAIN for blocked domains.

redirect

Redirect blocked domains to SDNS portal.

redirect-portal

IPv4 address of the SDNS redirect portal.

ipv4-address

Not Specified

0.0.0.0

redirect-portal6

IPv6 address of the SDNS redirect portal.

ipv6-address

Not Specified

::

block-botnet

Enable/disable blocking botnet C&C DNS lookups.

option

-

disable

 

Option

Description

disable

Disable blocking botnet C&C DNS lookups.

enable

Enable blocking botnet C&C DNS lookups.

safe-search

Enable/disable Google, Bing, and YouTube safe search.

option

-

disable

 

Option

Description

disable

Disable Google, Bing, and YouTube safe search.

enable

Enable Google, Bing, and YouTube safe search.

youtube-restrict

Set safe search for YouTube restriction level.

option

-

strict

 

Option

Description

strict

Enable strict safe seach for YouTube.

moderate

Enable moderate safe search for YouTube.

external-ip-blocklist <name>

One or more external IP block lists.

External domain block list name.

string

Maximum length: 79

config domain-filter

Parameter

Description

Type

Size

Default

domain-filter-table

DNS domain filter table ID.

integer

Minimum value: 0 Maximum value: 4294967295

0

config ftgd-dns

Parameter

Description

Type

Size

Default

options

FortiGuard DNS filter options.

option

-

 

Option

Description

error-allow

Allow all domains when FortiGuard DNS servers fail.

ftgd-disable

Disable FortiGuard DNS domain rating.

config filters

Parameter

Description

Type

Size

Default

category

Category number.

integer

Minimum value: 0 Maximum value: 255

0

action

Action to take for DNS requests matching the category.

option

-

monitor

 

Option

Description

block

Block DNS requests matching the category.

monitor

Allow DNS requests matching the category and log the result.

log

Enable/disable DNS filter logging for this DNS profile.

option

-

enable

 

Option

Description

enable

Enable DNS filter logging.

disable

Disable DNS filter logging.

config dns-translation

Parameter

Description

Type

Size

Default

addr-type

DNS translation type (IPv4 or IPv6).

option

-

ipv4

 

Option

Description

ipv4

IPv4 address type.

ipv6

IPv6 address type.

src

IPv4 address or subnet on the internal network to compare with the resolved address in DNS query replies. If the resolved address matches, the resolved address is substituted with dst.

ipv4-address

Not Specified

0.0.0.0

dst

IPv4 address or subnet on the external network to substitute for the resolved address in DNS query replies. Can be single IP address or subnet on the external network, but number of addresses must equal number of mapped IP addresses in src.

ipv4-address

Not Specified

0.0.0.0

netmask

If src and dst are subnets rather than single IP addresses, enter the netmask for both src and dst.

ipv4-netmask

Not Specified

255.255.255.255

status

Enable/disable this DNS translation entry.

option

-

enable

 

Option

Description

enable

Enable this DNS translation.

disable

Disable this DNS translation.

src6

IPv6 address or subnet on the internal network to compare with the resolved address in DNS query replies. If the resolved address matches, the resolved address is substituted with dst6.

ipv6-address

Not Specified

::

dst6

IPv6 address or subnet on the external network to substitute for the resolved address in DNS query replies. Can be single IP address or subnet on the external network, but number of addresses must equal number of mapped IP addresses in src6.

ipv6-address

Not Specified

::

prefix

If src6 and dst6 are subnets rather than single IP addresses, enter the prefix for both src6 and dst6 (1 - 128, default = 128).

integer

Minimum value: 1 Maximum value: 128

128