About DNS on the Firebox
You can configure different kinds of DNS servers and services on your Firebox. Each DNS server and service has a different purpose and is configured in a different location in the Firebox settings. Some DNS servers take precedence over others.
With the available DNS servers and services, you can:
- Configure DNS servers that apply to all interfaces and local Firebox processes, or only to specific interfaces.
- Configure DNS Forwarding rules to send DNS queries for specific domains to different DNS servers.
- Enable DNSWatch if you have a Total Security Suite subscription key. Tip!
- Configure dynamic DNS (DDNS) to maintain the association between your domain name and a dynamic Firebox IP address.
For more information about dynamic DNS, go to About the Dynamic DNS Service.
For information about DNS best practices, go to Firebox Configuration Best Practices.
For information about how to troubleshoot DNS issues, go to Troubleshoot Network Connectivity.
DNS Servers on Your Firebox
Your Firebox includes DNS servers for DNS forwarding. You cannot configure the Firebox itself to function as a DNS server. Instead, you configure the Firebox to forward requests to the DNS servers that you specify.
The available DNS servers on your Firebox include:
-
Network (Global) DNS server
This is the default DNS server for all interfaces and local processes on the Firebox.
In Fireware v12.2.1 or higher, you can select to assign the Network DNS server to Mobile VPN with IPSec, Mobile VPN with L2TP, and Mobile VPN with IKEv2, and Mobile VPN with SSL clients. Or, you can select to use DNS servers specified in the mobile VPN configuration.
In Fireware v12.2 or lower, the Network DNS server is automatically used for Mobile VPN with IPSec, Mobile VPN with L2TP, and Mobile VPN with IKEv2. Mobile VPN with SSL does not use the Network DNS server; it uses the DNS servers configured in the Mobile VPN with SSL settings.
Network DNS Server Configuration
You can specify up to three Network DNS servers.
The first server in the Network DNS list is contacted before others in the list. If you have a local DNS server, make sure it appears first in the list of Network DNS servers.
Configure the Network DNS server in the DNS/WINS network settings:
-
- Policy Manager — Select Network > Configuration > WINS/DNS
Network DNS Server Precedence
DNS server settings specified in mobile VPN configurations take precedence over the Network DNS/WINS server settings.
If the DNS forwarding feature is enabled, Conditional DNS servers specified in forwarding rules take precedence over the Network DNS server. This is also true for traffic generated by the Firebox itself (known as Firebox-generated or self-generated traffic).
If DNSWatch is enabled:
- If you have a local DNS server that appears first in the list of Network DNS servers, DNSWatch does not take precedence over that server.
- If DNSWatch enforcement is disabled, DNSWatch DNS servers take precedence over Network DNS servers configured on your Firebox, except for a local DNS server that appears first in the list, only for requests generated by or addressed to the Firebox IP address.
- If DNSWatch enforcement is enabled, DNSWatch DNS servers take precedence over Network DNS servers configured on your Firebox, except for a local DNS server that appears first in the list, for all outbound requests on that interface.
To see which DNS servers are in use on your Firebox, select Front Panel > Interfaces > DNS Servers in Firebox System Manager, or select Interfaces > Detail in Fireware Web UI. For more information, see the DNS Server information section in this topic.
For more information about the Network DNS server, go to Configure Network DNS and WINS Servers.
-
-
Interface DNS server
This is an optional DNS server that you can configure for an interface.
Interface DNS Server Configuration
You can specify up to three DNS servers. Configure the Interface DNS server in the DHCP server settings for an interface:
- Fireware Web UI — Select Network > Interfaces > [Interface Name] > Edit > DNS/WINS
- Policy Manager — Select Network > Configuration > [Interface Name] > Configure > Use DHCP Server > Configure DNS/WINS Servers
Interface DNS Server Precedence
The Interface DNS server takes precedence over the Network DNS server and the Conditional DNS server.
If DNSWatch is enabled with enforcement on, the DNSWatch server takes precedence over the IPv4 Interface DNS server.
For more information about the Interface DNS server, go toConfigure an IPv4 DHCP Server.
-
Conditional DNS server
This is the DNS server for the domain names and interfaces that you specify in a conditional DNS Forwarding rule.
Conditional DNS Server Configuration
Configure this server in the DNS/WINS network settings:
- Fireware Web UI — Select Network > Interfaces > DNS/WINS > DNS Forwarding
- Policy Manager — Select Network > Configuration > WINS/DNS > Enable DNS Forwarding
Conditional DNS Server Precedence
The Conditional DNS server takes precedence over the Network DNS server and the DNSWatch server. This is also true for traffic generated by the Firebox itself (known as Firebox-generated or self-generated traffic).
For information about DNS Forwarding, go to About DNS Forwarding.
-
DNS server from your ISP
This is the DNS server provided by your ISP.
If your Firebox is configured as a DHCP client, it receives DNS servers from your ISP.
If your Firebox is configured as a PPPoE client, you can select whether to receive DNS servers from your ISP. If you do not select this option, the Network DNS server configured on the Firebox is used. You cannot manually configure DNS servers in the PPPoE settings.
For external modem interfaces, you can manually configure up to two DNS servers. If you do not configure DNS servers in the modem settings, the Firebox receives DNS servers from your ISP.
For information about DNS servers for external interfaces configured for DHCP or PPPoE, go to Configure an External Interface.
For information about modem interfaces, go to About Modem Interfaces.
ISP DNS Server Configuration
For a modem interface, you can manually configure DNS servers:
- Fireware Web UI — Select Network > Interfaces > [modem interface] > Edit
- Policy Manager — Select Network > Configuration > Interfaces > [modem interface] > Configure
ISP DNS Server Precedence
Network DNS servers take precedence over DNS servers from your ISP and DNS servers manually configured in the modem settings.
If DNSWatch is enabled, DNSWatch servers take precedence over DNS servers from your ISP and DNS servers manually configured in the modem settings.
-
DNSWatch DNS server
DNSWatch is a feature that monitors DNS requests through the Firebox to prevent connections to known malicious domains. When you enable DNSWatch, two DNSWatch DNS servers are added to the list of available network DNS servers on your Firebox.
When you enable DNSWatch on your Firebox, you must decide whether to enable DNSWatch enforcement. When enforcement is enabled, the Firebox redirects all outbound DNS requests from that interface to DNSWatch DNS servers. When enforcement is disabled, the Firebox redirects outbound DNS requests from that interface to DNSWatch DNS servers only when the DNS request is addressed to the Firebox.
DNSWatch Configuration
To configure DNSWatch settings, from Fireware Web UI or Policy Manager, select Subscription Services > DNSWatch.
For more information about DNSWatch, go to About WatchGuard DNSWatch.
DNSWatch Precedence
If DNSWatch is enabled with enforcement off, DNSWatch DNS servers take precedence over these servers only for DNS requests addressed directly to the Firebox, or generated by the Firebox:
- Public Network DNS servers configured on your Firebox
- DNS servers from your ISP
If DNSWatch is enabled with enforcement enabled, DNSWatch DNS servers take precedence over these servers:
- Public Network DNS servers configured on your Firebox
- DNS servers from your ISP
- Interface DNS servers
- DNS servers manually configured on a network host
DNSWatch does not take precedence over the Conditional DNS servers specified in DNS Forwarding rules.
For more information about DNSWatch server precedence, go to DNSWatch DNS Settings Precedence on a Firebox.
-
Mobile VPN DNS server
In Fireware v12.2.1 or higher, in all mobile VPN configurations, you can select to:
- Assign or not assign the Network DNS/WINS settings to mobile clients
- Assign settings specified in the mobile VPN configuration to mobile clients
In Fireware v12.2 or lower:
- The Network DNS/WINS servers automatically are assigned to Mobile VPN with IPSec, Mobile VPN with L2TP, and Mobile VPN with IKEv2 clients.
- You can specify DNS and WINS server settings in the Mobile VPN with SSL configuration. However, you cannot select to assign the Network DNS/WINS settings to Mobile VPN with SSL clients.
Mobile VPN DNS Server Precedence
DNS server settings specified in the mobile VPN configurations take precedence over the Network DNS/WINS server settings.
DNS Resolver and Cache
If you enable the DNS Forwarding or DNSWatch features, a DNS resolver (127.0.0.1) is automatically activated on the Firebox. The resolver caches the results of DNS queries up to 10,000 entries.
To resolve a DNS request, the Firebox resolver first searches its own cache. If cached information does not exist for the request, the Firebox forwards the request to another DNS server based on the DNS settings you specified on the Firebox.
To disable the DNS cache, in Policy Manager (Fireware v12.7 or higher):
- Select Network > Configuration > WINS/DNS.
- Clear the Enable DNS Cache check box.
To disable the DNS cache, in Fireware Web UI (Fireware v12.7 or higher):
- Select Network > Interfaces > DNS/WINS.
- Clear the Enable DNS Cache check box.
In Fireware v12.6.4, you must use the CLI to disable the cache. Specify the command no ip dns cache enable. For more information about this command, go to the Fireware CLI Reference.
After you disable the DNS cache, the Firebox does not cache DNS queries or resolve DNS queries from information in the cache. For example, if you have a DNS forwarding rule for the domain example.com, the Firebox forwards that request to another DNS server based on the DNS settings you specified on the Firebox.
DNSWatch DNS servers also have a cache that stores one week of data.
DNS Server Information
In Fireware Web UI, you can see the DNS servers your device uses on the Dashboard > Interfaces > Detail page. For more information, go to Interface Information and SD-WAN Monitoring.
The Firebox DNS resolver appears as 127.0.0.1 in the list of DNS servers on these status pages. Only the Firebox DNS resolver and up to three DNS servers appear here and are available to resolve DNS requests.
If DNSWatch is enabled, and a local DNS server appears first in the Network DNS server list, DNSWatch DNS servers appear after the local DNS server on these status pages. In this case, other DNS servers that appear in the Network DNS server list do not appear here and are not used for DNS resolution.
For example, if you have DNSWatch enabled, and a local DNS server appears first in Network DNS server list, DNS servers appear on these status pages in this order:
- 127.0.0.1 (Firebox resolver)
- Local DNS server
- DNSWatch DNS server 1
- DNSWatch DNS server 2
In this case, public DNS servers configured in the Network DNS server list do not appear on the status page and are not used for DNS resolution.