Fortinet FortiGate Series Administration Guide

Configuring FortiGate DNS services System Network
FortiGate Version 4.0 MR1 Administration Guide
206 01-410-89802-20090903
http://docs.fortinet.com/ • Feedback
About split DNS
In a split DNS configuration you create a DNS database on the FortiGate unit, usually for
host names on an internal network or for a local domain. When users on the internal
network attempt to connect to these host names the IP addresses are provided by the
FortiGate unit DNS database. Host names that are not in the FortiGate unit DNS database
are resolved by relaying the DNS lookup to an external DNS server.
A split DNS configuration can be used to provide internal users access to resources on
your private network that can also be accessed from the Internet. For example, you could
have a public web server behind a FortiGate unit operating in NAT/Route mode. Users on
the Internet access this web server using a port forwarding virtual IP. So the web server
has a public IP address for internet users. But you may want users on your internal
network to access the server using its private IP address to keep traffic from internal users
off of the Internet. To do this, you create a split DNS configuration on the FortiGate unit
and add the host name of the server to the FortiGate DNS database, but include the
internal IP address of server instead of the external IP address. Because the FortiGate
unit checks the FortiGate DNS database first, all DNS lookups for the server host name
will return the internal IP address of the server.
For an example of how to configure split DNS, see “To configure a split DNS configuration”
on page 208.
Configuring FortiGate DNS services
This section provides a general procedure for configuring FortiGate DNS as well as
specific procedures for configuring a FortiGate interface to provide DNS services in
different ways.
General FortiGate DNS server configuration
1 Go to System > Network > Options and add the IP addresses of a Primary and
Secondary DNS server.
These should be the DNS servers provided by your ISP or other public DNS servers.
The FortiGate unit uses these DNS servers for its own DNS lookups and can be used
to supply DNS look ups for your internal networks. See “Configuring Networking
Options” on page 204.
2 Go to System > Network > Interface and edit the interface connected to a network that
you want the FortiGate unit to be a DNS server for.
3 Select Enable DNS Query.
When you select Enable DNS Query, the FortiGate unit relays all DNS queries
received by this interface to the DNS servers configured under System > Network >
Options. Select Recursive or Non-Recursive to control how this works.
4 Go to System > Network > DNS Database and configure the FortiGate DNS database.
Add zones and entries as required. See “Configuring the FortiGate DNS database” on
page 208.
recursive Look up domain names in the FortiGate DNS database. If the entry is not
found, relay the request to the DNS servers configured under System >
Network > Options. Can be used for a split DNS configuration.
non-recursive Look up domain names in the FortiGate DNS database. Do not relay the
request to the DNS servers configured under System > Network > Options.

Fortinet FortiGate Series Specifications

General

Model	FortiGate Series
Category	Firewall
Throughput	Varies by model
Interfaces	Varies by model
Concurrent Sessions	Varies by model
VPN Support	Yes
High Availability	Yes
Firewall Throughput	Varies by model
VPN Throughput	Varies by model
IPS Throughput	Varies by model
NGFW Throughput	Varies by model
Threat Protection Throughput	Varies by model
New Sessions per Second	Varies by model
Power Supply	Varies by model
Security Features	Firewall, IPS, Application Control, Web Filtering, Antivirus, VPN
Virtual Domains	Yes
Form Factor	Desktop, Rackmount