Fortinet NSE4_FGT-7.2 — FortiGate Firewall — Section 1: FortiGate Firewall V6.4 1 Part 13

17. Lecture-17: Configure DNS & DNS Server in FortiGate.

An initial working lane reconfigure DNS. And the second first reconfigure interfaces, then we move to the NSA. What is DNS? DNS means domain name system, either domain name server. These are the abbreviation of business. Basically, DNS is a large database. Okay, we are. There are many computers reside in many server in the world, but Veera that are being DNS server throughout the world and you can find those that are being DNS server. I’m talking about what are not limited to the organization.

So, don’t be confused. I’m just giving you what a story about DNS to end the war. We are being the NSA. These are the location, most of them in USA. These are traditionally and etc. Then they mention only 12 or 13 DNS somewhere in the world. And these 13 servers start from this one. They give them these name B, c, d, e, f, g, h i j k, l, m. And where are these? So, the implication of these are in USA and Japan and London and so many and B groups are these are the location and C and so on.

So, these thirteens are what has many replantation all over the world everywhere. But these are 13 minutes or so whenever you want to buy any software like YouTube dot com. I’m typing your new dot com so we know what you want to buy in your domain name, so this name will be checked in these 13 DNS server there. Does somebody deserve this name or not? okay, so then they’ve been allowed to use this domain name and basically this YouTube dot com. If I go to CMT and look up and W-W. You do not come so behind that, you do not come how many these are working, these are the some of them is IPV six in.

Some of them is. Suppose, if I typed this on the Internet and here on YouTube, dotcom the way into Google because YouTube is working under Google now is one.

So, that’s why some of the booths will open. What is Google most of the time? So, if I were be maybe check any other IP.

So, this is also under Google.

So, it’s better to give you another example of Facebook, because in this one you will be confused.

So, does look up. And in the meantime. Facebook dot com. This is a Facebook dot com and let me drive this here on Facebook dot com.

So, rather than to memorize an IP address, it’s better to Facebook. Let everybody know who is doing at least a second word, IP to name a name to IP, these 13 so on, which is located throughout the world. And these are the location of these businesses all over the world.

So, it’s basically like a phone and your phone. You save my name by maybe another instructor or something.

So, when you dialing my name, basically you are not naming my name behind the name. You are dialing my own number, but far too easy to remember. You give them the name where you give them, then you can tell by directly zero zero nine six and say, oh my, no, no, it’s not possible for a human to remember so many number. Maybe you will remember some of the good guy. They can memorize many number you want. I don’t know my father phone number. I give them the name because it’s it difficult to memorize your brother in those guys phone number.

So, DNS is like a phone number. With their name to I’ve been able to name. Okay, and we know what you buy, you want to buy and you do mandaville there, like a phone number can be the same.

So, within one city, so that you checking here. Now, this DNS is being divided like this where the whole domain name, the last one is ruled because there is a dark by the way, at the end of this world, there is a dark way, if I type that it will not affect anything else. Openable to think there is a small dot which is hidden. We call them, you know, you can type anything. It will work no matter how come it will not. The only thing is there is a dot which we call them root. On the road, there is darkness dot com. What did you mean, go? I did so many top level domain. And this is this is Orji and if I open YouTube dot com, this is commercial Sequim commercial. It is what Deji organization. There are dot me for personal use and so many other like organization gonnerman one is go. There is not like a network dot com commercial.

So, this is kind of level domain after dark, which is a hidden Darbie. It is then second level domain. Like here, this one is somewhere. This is second level domain, we call them in this hall, we call them you all are together HHTTP through Serrador. What did you do at. Okay, keep in mind, there is one another thing is, well, after this top level domain being country name, we know you are in any country, it will show you there one. Suppose, if I go to Google dot com. Local.com, I don’t to show me or not, okay, because I’m using another word or they will type here.

So, if you visit by default, it will take from the UK. It will show you UK because I’m not in Newcastle. It will make them UK, USA and so on. Yeah.

So, why countries also. Because I mean, so the answer to really dig this one, because it’s the correct one.

So, we are like well there is a country named as well and subdomain, there can be like FPP WWI, there is any subdomain as as well.

So, if you go to Google they have a subdomain mill. If I’m here man, we are going to say maybe mail or something. There should be men and there is another man’s. Anyway, something is like this one.

So, this is called subdomain. Okay, this is a Labor Day, you are. Okay, so let me show you, I was telling you something. Yeah, so this is fully qualified domain name, we call them if KDDI in this fully qualified domain name and all together, because then you are also the source locator. Okay, so this is DNS 13 business all over the world. This is the story now coming to look at DNS and every organization you can create your local businesses. Well, let me show you locally. And if I hold my server. And should go to business, is there any business okay? This is my local audience and so there is floodwater to come soon and rehearsal goes on and forward. Look on normally we put a name and it was Look-Up Zone. We are putting a piece because I told you, Dennis is basically keeping both the record, your phone number and name.

So, IP address and domain name, okay.

So, there are two location, by the way. I need to configure one quickly.

So, let me quickly give them any zoom test because I need to show you something. They are inside just to test here. Yes, come up. It’s organo and reverse lookup zone. You have to put that in worst thing, okay? And I don’t know what is my ampicillin with this one. It’s coming here.

So, this is Lochlyn by the way you want. And local DNS you will find those 13 businesses will start up authority. There is one place to show you those thirteen selwa. Where I can find I figured this place to show you 13 DNS servers, so should be like here, maybe let me go there. And. It is 13 Deerness, those 13 Denisova, which we discuss and so are available locally and as Sarah as well. It’s by the wrist not showing me here. Let me find out. Maybe I forgot this this name.

So, it should be here. Those 13 deaths are all for some reason. It’s not showing me here those 30. And so maybe I’ve forgotten to put the proper place. Let me check here. Oh, it should be here, by the way, maybe because I just can’t figure this one.

So, it’s not available. It has to be here those 13 by before we know what you can figure out.

So, let me quickly configure this one. The 192 168 eight, if we give them anything, I don’t care. And let me check now. I need to show you those 13, which is for some reason, it’s not showing here. It’s. Okay, yes, not here anyway. Let’s go here now so you can configure your local business as well and Cisco and sorry and Windows are two thousand three server 2000 in Silver 2012 or 2016 and 2019. And also in Linux’s with.

So, in local audiences, there is a or a record is basically, but I’d be for if I go back there. Let me show you. If I write, there is a new host. Okay, suppose I give them name first, so the ABC suppose an IP address 192 168 in Daquan, suppose it means finder, which is the opposite one here.

So, if you say click here, it will create hostname. Okay, this is the hostname, which is Berringer. Endicott is what I do for if no one for IPV six symbols A, B, C, B this time and you die I suppose two thousand one call and one is lost.

So, this is for time a very successful time. And before this is one we call them Eiríkur and it will create automatically Blinder’s with this one. The point and now this is a database not created. Okay, so what you need to do is Edgard if you want to configure anything.

So, now I can bring A, B, C by name to DNS will translate them to Eldard one.

So, if you want to bring in that one.

So, this method we use here for Ericsson and for maybe six for a, there is another thing, c, num, num, canonical num either it’s like alias name, either we call them what is called nickname.

So, you gain a nickname. What is nickname by the way. Facebook original name is this one. Let me give you you do either Google. And as you go, w w will not come, you know, Google or name is this one for search safe Google dot com, this is the original name of Google, but we know Google dot com by the alias name. And this alias name is basically CMM and DNS to in business. They said Google dot com. We know everybody we know by it means by C name. We know Google because the original name of the Google is this one.

So, I can do this one and my business is with local DNS if I go there and right. Click there is a new alias, either CMM canonical name either. Nickname.

So, suppose I want to give my nickname, suppose w w w. And what is the fully qualified domain name I will take from ABC so ABC can be called by WWE? Well. Now, this is a senior.

So, I in the original name is ABC Budapest, but I can bring and I can call and I can do anything by this name and he’s going to do this for me. Dennis again, BNSF somebody w w w x. It means ABC daftest and ABC your best means 102 168 six. That one did.

So, I Googled their own name is this one. But we know by alias Google dot com w w Google dot com.

So, this also Dubai will be announced by CNN. We can do it. And then there is a mixed record in DNS we can do in exchange for email purposes if I will make and show you quickly.

So, if you right click there is this one email exchange for the email addresses you can use. This method is will be durational pointer. This is the opposite of the name. You can put the pointer as well name.

So, what I show you this will be by default. This Dearborn’s zone dudin man, Zonda, there, it will be by default, and there is startup authority eSport, it will show you full detail of the business. Let me go back and show you quickly these two, and you will find by default this one startup authority. If you click start to maturity, it will show you the detailed response or to retry, expiry and on to deal with your other thing related to this DNS, it will show you this data and name server will just be named to which server you are using for fully qualified domain name. Okay, so these two entries also and I show you on the entry why I’m showing you this now. I’m coming to our own DNS info bibliophile. Well, that was the story of DNS in quickly and for the get firewall reconfigured DNS. It’s important. Otherwise your target will not work not for the actual war, but your system will be not reachable to the Internet.

So, how we can configure if I log in here. Admen. One, two, three.

So, last time mean we configure a smart apology, reconfigure DNS.

So, now you’ll be it’s why we need this one.

So, on the network interfaces, there is a DNS click on DNS domain name system, either domain name server. By default, you can use 40 Great Firewall server as a DNS. This is very different probability and it’s in your country. Now, will you be talking to the Inocente if one business is not available, the other will work through the one which is first, second and probably Dennis industrialist’s. You can do DNS and we can give our local domain name gesticulated domain name up to a domain name. You can go MBC dot com link and plus two, three, four, five, six, seven and eight. Now you cannot do any more to us to in local domain name. If you Luman in your environment you can put here like in my guest reconfiguring things this dot com. Suppose, if you want to do this dot com, if you need more click on a place. But this is for the DNS or to convert your IP to name and name the IP, you can specify your own, which we done it last time and that out it and I say one dark one one one. That one is faster than it is belong to Google and this one is a new one. One one one. I don’t know who belongs to this, but this one is the fastest in the world DNS server. What you can Jinko, the thing which is start by DNS, because everybody is using a Boolardy and Saslaw, so you can use one one one DNS as well and decide if you want a security and nobody can attack on you.

So, you can make deals unless we’re discussing other things so insecure where by default is desirable, you can enable it will use this certificate because you listed what a certificate and if you want to enforce it will order to use this certificate. Okay, and which is using it will show you those DNS, which is open automatically to ensuring you here in business, or it will show you that here, if you Muleshoe it here, is being but not reachable because you are not reachable. There is no Internet access.

So, that’s why it’s one ninety millisecond and last update has been thirty five data control and accordionists in this one which is reachable. This is our management interface one. This one.

So, that’s why issuing this one so we can configure DNS here so that you can both primary and secondary and you can hold a domain name if you are using local domain. And also you can use your local DNS entry as well and apply this is the way to configure DNS info together. But the question is, is it possible to use for Biggart firewall as a DNS Sahwa, just like I created here this one, because this is my local business.

So, yes, you can go to system. More to feature visibility and from here, a DNS so we can find DNS.

So, let me go to next generation. Theories are DNS database. As mentioned already, it is possible to configure for the firewall is a local DNS, which is not recommended. And neither you will see. But if you have a small environment, because for Biggart firewall, mostly use in smaller anonymization is because this is one of the best for a small organization and easier to configure to in small organization. They don’t have their own DNS. Maybe add to that into their Donehue so you can configure for bigger firewall as a DNS.

So, what is the one which we just discussed? Those are not all DNS entry, just like in our system to enable this DNS database. Okay, and now when you go to network you will see another DNS servers before it was not available. And here you can see you can configure this for the Great Firewall is our own DNS server. First, when I said DNS service is an interface on which interface you want to enable a DNS.

So, in my case, because definitely has fallen this Milind for number two.

So, I will say create new OC and I will say no to Berlin. Definitely Farleigh better more days. Recursive Non-drinker Nondrinkers forwarding to system DNS.

So, what is the consumer and consumers, they don’t know anything, they will forward the entry when they hear somebody say that who is dot com? So, it will follow up to the D.A. and other business. To ask them, do you know this guy nondrinkers, who means it means you have everything in your own database, Sam, like I hear here. I ABC, so if somebody is bringing NBC, I will replay them nondrinkers that are yes, I know everything about ABCDE because it’s been configurator me.

So, you can use this to mother and father into system business, which is we just configure the system DNS. Anyway, subdominant, which requirement will enable? But suppose I said you’ve got to see the because you were they were in okay, so my interface is being selected. You can create another interface as well. It’s not only what maybe you have Bamsey where you want to use DNS or two for those people so you can create a new and if you want to edit them, you can edit and you can delete it. And this is the more recursive. Now coming to the entry database and the interface unwaged interface, I will resume DNS detail means somebody will ask me to provide me IP to name and name Deuba.

So, that board number is for number two. But what they will now do you think and be confident here and DNS database created new. Now it’s asking me Benison, the same thing which I done here and locally, what is my zone name? This is my local zone. But look, I just want to do a name test. The same thing you have to hear or said. This is my DNS zone domain name, the same which I created here. A domain name. My domain name is Desideratum, something I go there just randomly, maybe another company.

Something is supposed to start local because dot com is a Web site.

So, let me hear them local and hostname up from remaster in ocean and you can you’re supposed DNS and content email address. Simple. Let me give them your article. Either ask local email address and guess if you want to send local authority.

So, this is the same thing which I have done here, this part comes when I click next niceness and creating those zone I created here by this very digital video, digital video I just show you here and some somewhere here is the detail for how long to keep this record. And answer so you can barely hour, minute and second, so my zone is ready then. This is a 32. Either unattracted you started your business means basically they will keep all the records, it means if somebody requests so they know the record, they will answer to. Yes, I held this data and none of that had to do it means they don’t give anything they will ask.

Somebody else might be Google DNS. Ajoy forgot to show you this one time monster, Arcelia.

So, master means you will put all the entries on your local DNS detail, your system, your server detail manually, just like I put here. Raise. Like NBC, W-W, and you can give maybe you have someone one, so give the tribe warmed up on that one. Okay. Setsuo, 11. Hawaii is not taking, so let me give them one nine to two one sixty one one sold out to hundreds, of course.

So, I cleared server one, Draeger Salvadori Conservatory and so on. The same thing for Mostro toward the end trimline really weird. I would show you slave means it will change everything. Look at change. It will follow up with some other one master, one who held the Rekha.

So, it’s up to you, you need to master one, so then in master, you have to put all the detail in here is that you could create new and these are I just show you this way. I was showing you in, you know, a.. But I before IPV six for time a name said what I just saw. You can only go to name the alias name. I just who you Manser and therefore I before four and six I show you.

So, that’s right. Now I see IP addresses one one one fully qualified vehicle that it’s already hostname. Hostname is cellular samples, cellular one. And I believe this is one hundred one. Insecure way and okay, so one sorry, Mr. one dark, one in, okay, so one entry has been created just like the one I created to create a new one.

So, there is a subtle tool. And Time Warner Hundert. To again, I don’t mistake one to and okay, because I use master to I aim to put on the record like this where somebody said it, who is someone one.

So, I will convert them to one, one, one. If somebody requests by IP, I will convert them to hostname because I am a master and I’m not that not a non-starter. Do I want the record if I thought I did.

So, I don’t have I will follow up to someone else and view means shadow and public shadow means I will use this DNS locally and public means public people will also use to access these data.

So, it’s up to you to type is then is done DNS record and ok.

So, at the end of the day, if you don’t know anything, this one, you need to know this one. The answer is basically if you are working in a small organization and if they asked you, then we don’t have to do that intrigue and we don’t have any Denisova. And so you said, don’t worry, I will have configured for your firewall as they’re being set up so you can configure your firewall is a DNA sample for two things locally to keep the trigger. Either is a slam to fly to another business, maybe you have another business in another branch, or maybe you want to fly them to Google DNS so you can configure and do it. And from which interface the detail will come to ask you. You can configure their interface.

So, don’t worry if you don’t know it’s okay and maybe I can be now because I give them rangey, but I will try to execute. Being wondered, wondered when I saw him give it to something, so I wondered why no one is being one and being by name is when I don’t know which name I give someone one. I think so, yes. Look, I need to check. I think so I give them this name. I need to check and give them let me go because I give them those DNA entry. Okay, so let’s see. Server one and what is server one, okay? Nowadays, this is some of them.

So, let me go big. Okay, this is not based on policy and. Let me clear from here.

So, you think, what is the name is SKITE or we are one of these? I do them wrong.

So, I need to put like this one to bringing one one one basically. Who is doing this if I do anything? No, it will not be so easy. If I say six, it was an Ireland six. She’s amazing, definitely right, because we have configure our 40 year firewall locally as a DNS to get the record from the you know, it’s not being server one if you were there and four six six are keeping a look at the channel, unable to resolve hostname, who they say this being server.

So, at least you know the idea if this one is not clear to you, so please don’t mind, just go through it, if not. But this has to be sure to you that we can use our local audience and we can use this Denisova as well to specify and say, yes, go back to the. And so going to be one of the best.

So, of all people for that, yeah, let me show you let me go back here. You know, the aliens are Dennis Rodman is really foundational for order. And there is also and this issue will also find a way forward. Let me check, because I didn’t have this one properly, so maybe I will not find. But let me show you the asone transfer so you can transfer to specific IP and also conditional forwarder if nothing is found and pull forward something to another Deonna supposed to enter it. Okay, so the same thing you can do here as well if you are looking forward to specific DNS before and one one one IP and you can configure Manea that I think you have to edit this one is that you can configure to find where the card is not found here.

So, it will forward to the initial spot order as well. Oh, not System-Wide. Yeah. If you help configure to be innocent.

So, it will be our DNS IP, not a system IP when we have something of okay.

So, this is a DNS entry so you can configure DNS from CLIA C.M.A. We will do in detail later in the course. But for now, let me show you how we can configure this business on this one. From the command line, so the command line and second assistant D.A. and enter now you will go to the DNS records center.

So, now in DNS and send if you don’t know anything, just questionmark the sister services and questionmark. Look at this.

So, yes, I need that one.

So, let me clear the screen.

So, certain primary. And from the way I put it, a little something is wonderful, wonderful, wonderful one. And service to country for there their one is for not for, not for okay and and means and you go from the inside so you can configure the image from command line as well.

So, if I refresh now so you will see this will be two different. Okay, so let’s see, it’s one one and four.

So, I from the graphical view, either from command, you can do change their DNS. Okay, so this was the story of Dennis.