Locking down your network DNS traffic using Fortinet

Here is a subject that is near-and-dear to me. I love collecting and analyzing DNS traffic. It is extrmemly informative and fun to review. I run into a lot of customers that put themselves at risk for no reason. I had a customer that wanted to disable recursive DNS on their Active Directory domain controllers. I explained to him that if they did that, their Internet would break save local queries to domains that the DC has as zone file for. In comes the Swiss Army Knife of firewall security. You have some options. O1 – Convert the Fortigate to a recursive DNS server or O2 – Query the Fortiguard DNS Servers directly.

Here is my suggestion:

Step 1 – Convert the Fortigate into a recursive DNS Server or use the FortiGuard Servers as your forwarders.
Step 2 – Change your DC (DNS) Servers to forward request to the Fortigate (or FortiGuard Servers) instead of the Root Servers or any other server that might be configured.
Step 3 – Create a policy permitting the Internet DC (DNS) servers to query the Fortigate and/or Fortiguard DNS Servers.
Step 4 – Block all other DNS traffic egressing your network.

STEP 1

To enable recursive DNS on your Fortigate, you will need to enable the recursive DNS queries on the ‘inside’ interface or the ones that you want to service the DNS queries from.

GUI

CLI

Next we will create two objects for the FortiGuard DNS Servers

Now, create ‘address objects’ for the DC if you do not have them already.

STEP 2

Change your DNS Forwarders to the Fortigate or Fortiguard DNS servers. This is beyond the scope of this post, but here is a good link.

STEP 3

Create a policy that permits the DNS servers accessing the DNS servers at Fortiguard Labs. If you are going to use the Fortigate as the recursive DNS then you do not need this piece. However, if you are NOT going to set up the Fortigate as a recursive DNS, then you will need to give the servers access.

STEP 4

Block all other DNS traffic egressing your network. Remember that you will need to add the ‘Incoming Interface’ of all the interfaces that would generate DNS queries.

Now I will show you what my policies look like.

Also, you can configure ‘DNS Filters’ in the NETWORK, DNS SERVER section:

DNS Filter will give you additional capabilities such as blocking cateogries, etc.

I hope this helps.