Hot!Split DNS for local domain resolution: working in CLI, not on Command Prompt

Author
shawn@ietech.ca
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/01/15 16:44:17
  • Location: Toronto, Canada
  • Status: offline
2020/01/15 17:20:08 (permalink)
0

Split DNS for local domain resolution: working in CLI, not on Command Prompt

I'm a newbie, so apologies if this seems like a simple question... I'm working on a FortiGate 60E running firmware 6.0.4.
 
I'm trying to setup Split DNS for resolution of local VMs. I've followed the instructions (Master, Shadow, Non-Authoritative, etc.) and added the WAN to the "DNS Service on Interface". I've also added the local domain to the interface (ietech.local). I've set the WAN to Recursive... Unfortunately, I'm not able to get the Windows command prompt to return anything but the fortinet  servers. However, when I execute a ping on the FortiGate CLI, it properly resolves the addresses / hosts... I'm guessing this is something simple that I'm overlooking... Any ideas?
 
I appreciate any help / thoughts available as I've been struggling with this for a while now...
 
Cheers,
Shawn
 

Attached Image(s)

#1

2 Replies Related Threads

    Dave Hall
    Expert Member
    • Total Posts : 1608
    • Scores: 174
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: Split DNS for local domain resolution: working in CLI, not on Command Prompt 2020/01/17 14:25:44 (permalink)
    5 (1)
    I think you want to set up a DNS server (database) on the internal LAN side rather than on the WAN interface.  Then you need to make sure the IP address for the interface (that has the DNS service tied to) is handed out to clients via DHCP. 

    NSE4/FMG-VM64/FortiAnalyzer-VM/5.4/6.0 (FWF40C/FW92D/FGT200D/FGT101E)/ FAP220B/221C
    #2
    shawn@ietech.ca
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/01/15 16:44:17
    • Location: Toronto, Canada
    • Status: offline
    Re: Split DNS for local domain resolution: working in CLI, not on Command Prompt 2020/01/17 18:57:30 (permalink)
    0
    Thank you Dave for your support in this!!
     
    I have been able to configure the fortigate with the DNS server on the internal LAN!! I then set the system to use the IP address of the fortigate on the DHCP as you suggest. It works great and am very happy with the performance :)
     
    As a note, I also found that this did not work with the ietech.local domain. Although I don't know the details, the ".local" seems to be reserved with special rules around it... Here is a copy of the script I ended up using in case anyone else finds this thread and is looking for a solution:
     
    Thanks again!
    Shawn
    --== CLI SCRIPT ==--
     
    config system dns-database
      edit "corp_forward"
        set authoritative disable
          config dns-entry
            edit 1
              set hostname "ledger.ietech.ca"
              set status enable
              set ttl 0
              set type A
              set ip 192.168.1.118
            next
          end
        set domain "ietech.ca"
        set forwarder "192.168.1.99"
        set source-ip 0.0.0.0
        set status enable
        set ttl 86400
        set type master
        set view shadow
        unset allow-transfer
        set contact "hostmaster"
        set primary-name "dns"
      next
      edit "corp_reverse"
        set authoritative disable
          config dns-entry
            edit 1
              set hostname "ledger.ietech.ca."
              set status enable
              set ttl 0
              set type PTR
              set ip 192.168.1.118
            next
          end
        set domain "1.168.192.in-addr.arpa"
        set forwarder "192.168.1.99"
        set source-ip 0.0.0.0
        set status enable
        set ttl 86400
        set type master
        set view shadow
        unset allow-transfer
        set contact "hostmaster"
        set primary-name "dns"
      next
    end
     
    #3
    Jump to:
    © 2020 APG vNext Commercial Version 5.5