DNS session helpers

DNS session helpers work in the background, passively learning hostnames and A/AAAA records from the DNS traffic that is being forwarded through the FortiGate. The learned address records are then stored as a hostname cache and FQDN addresses. These stored address records are subsequently utilized by the DNS proxy. This passive learning approach enables FortiOS to correspond with DNS traffic and acquire address records when possible, eliminating the need for active FQDN queries or reverse DNS lookups. This reduces the necessity to connect to the actual server, effectively diminishing the overall FortiGate traffic to the DNS server.

FortiOS incorporates two types of DNS session helpers: dns-udp and dns-tcp.

By default, FortiOS enables the dns-udp session helper and disables the dns-tcp session helper. This default configuration is based on the fact that the majority of DNS traffic occurs over UDP due to its lower overhead and faster response times. However, FortiOS provides the flexibility to enable dns-tcp if required.

To enable the DNS session helper from listening on TCP port 53:

config system session-helper
    edit 0
        set name dns-tcp
        set port 53
        set protocol 6
    next
end

Use the show system session-helper command to view the current session helper configuration.

To accept DNS sessions you must add a security policy with service set to ALL or to the DNS pre-defined service (which listens on TCP and UDP ports 53).

Disabling DNS session helper

In certain scenarios, you might consider disabling the DNS session helper. This action essentially removes it from the session-helper list, preventing the session helper from listening on port 53. Once the DNS session helper is disabled, the hostname cache and FQDN addresses will no longer be curated from the DNS traffic. Consequently, the DNS proxy will need to dispatch requests to servers to retrieve the necessary information, which could potentially increase the load on the DNS proxy.

DNS session helper is required for wildcard FQDN addresses, as they are initially empty. The FortiGate analyzes client DNS responses, adding any IP addresses found to the relevant wildcard FQDN object. See Using wildcard FQDN addresses in firewall policies.

To disable the DNS session helper from listening on UDP port 53:

1. Enter the following command to find the DNS session helper entry that listens on UDP port 53:

   #show system session-helper
   …
       edit 14
           set name dns-udp
           set protocol 17
           set port 53
       next
   …

2. Enter the following command to delete DNS session helper:

   config system session-helper
       delete 14
   end

Similarly, the DNS session helper can be disabled from listening on TCP port 53.