Optimizing hostname resolution in non-AD environments

In a non-Active Directory (AD) environment utilizing FortiGate as both the DNS and DHCP server, several key configurations are required for ensuring effective hostname resolution:

1. PTR records:

   These records are essential for reverse hostname resolution and enable IP addresses to be mapped back to their corresponding hostnames. For instance, if a device has the IP address 10.10.10.13 and the hostname pc1, a PTR record ensures that querying this IP returns pc1.pochiya.net. Without PTR records, reverse lookups would fail, potentially disrupting network services or applications that rely on this functionality.

2. Search domain configuration:

   In an AD environment, domain-joined devices automatically recognize the domain context, allowing hostname resolution without the need for the full FQDN. However, in a non-AD setup with FortiGate, explicit configuration of the search domain is necessary. This configuration informs client devices about the domain suffix to append when resolving hostnames, facilitating access using just the hostname.

3. DHCP integration:

   FortiGate can automate the distribution of DNS settings through DHCP options, reducing manual configuration. Devices receive the required configurations automatically when joining the network, streamlining administration and ensuring consistency across devices.

4. Manual configuration for static IPs:

   For devices with static IP assignments not managed by DHCP, manually adding the search domain to each device's DNS settings is required for hostname resolution.

5. Monitoring and maintenance:

   Regularly updating PTR records and verifying search domain configurations are critical to prevent DNS resolution issues.

Configuring PTR records and setting up proper search domains in a non-AD environment with FortiGate is crucial for reliable network services and seamless device communication. These configurations make sure that hostname resolution works efficiently, enhancing user convenience and overall network reliability.

Example

In this example, a small corporate network is connected to a FortiGate firewall that also serves as the DNS server for the internal domain pochiya.net and the DHCP server. To ensure accurate hostname resolution, the FortiGate is configured with reverse (PTR) records and proper search domain settings.

To configuring DNS server and DNS entries for a PTR and address record in the GUI:

1. Go to Network > DNS Servers and in the DNS Database table, click Create New.

2. Configure the following:

   Field	Value
   Type	Primary
   View	Setting
   DNS Zone	internal
   Domain Name	pochiya.net
   Hostname of Primary DNS	corporate
   Contact Email Address	admin@pochiya.net
   Authoritative	Disable

3. In the DNS Entries table, click Create New and configure the following to add a PTR record:

   Field	Value
   Type	IPv4 Pointer (PTR)
   Hostname	pc1
   IP Address	10.10.10.13
   Status	Enable

4. Click OK.

5. In the DNS Entries table, click Create New again and configure the following to add an address record:

   Field	Value
   Type	Address (A)
   Hostname	pc1
   IP Address	10.10.10.13
   Status	Enable

6. Click OK.

7. Click OK.

8. In the DNS Service on Interface table, click Create New.

9. Set Interface to port2 and Mode to Recursive to enable DNS services on that interface.

10. Click OK.

11. In the CLI, configure a domain to push the DNS suffix automatically.

To configuring DNS server and DNS entries for a PTR and address record in the CLI:

config system dns-database
    edit "internal"
        set domain "pochiya.net"
        set authoritative disable
        config dns-entry
            edit 1
                set type PTR
                set hostname "pc1"
                set ip 10.10.10.13
            next
            edit 2
                set hostname "pc1"
                set ip 10.10.10.13
            next
        end
        set primary-name "corporate"
        set contact "admin@pochiya.net"
    next
end
config system dns-server
    edit "port2"
        set mode recursive
    next
end

To configure a domain to push the DNS suffix automatically:

Modify the existing DHCP server configuration that is responsible for distributing IP addresses to the corporate network:

config system dhcp server
    edit 2
        set domain "pochiya.net"
    next
end

The full DHCP configuration should look like:

config system dhcp server
    edit 2
        set dns-service default
        set domain "pochiya.net"
        set default-gateway 10.10.10.1
        set netmask 255.255.255.0
        set interface "port2"
        config ip-range
            edit 1
                set start-ip 10.10.10.10
                set end-ip 10.10.10.200
            next
        end
    next
end

To verify the configuration:

1. Check the PTR record function using nslookup on a client device:

   #nslookup 10.10.10.13
   Server:  UnKnown
   Address:  10.10.10.1
   
   Name:    pc1.pochiya.net
   Address:  10.10.10.13

   The response should indicate that the IP address 10.10.10.13 is mapped to pc1.pochiya.net.

2. Test hostname resolution without specifying the FQDN using nslookup on a client device:

   #nslookup pc1
   Server:  UnKnown
   Address:  10.10.10.1
   
   Name:    pc1.pochiya.net
   Address:  10.10.10.13

   The response should indicate that hostname resolution works without requiring users to enter the full FQDN. Client machines will automatically append the search domain (pochiya.net) when resolving hostnames.