[Information]/[Fortinet] Fortigate

[Fortinet] Fortigate CLI Commands - DNS 설정

starterr 2024. 8. 12. 14:03
반응형

DNS CLI

 

DNS settings can be configured with the following CLI command:

config system dns
    set primary <ip_address>
    set secondary <ip_address>
    set dns-over-tls {enable | disable | enforce}
    set ssl-certificate <string>
    set domain <domains>
    set ip6-primary <ip6_address>
    set ip6-secondary <ip6_address>
    set timeout <integer>
    set retry <integer>
    set dns-cache-limit <integer>
    set dns-cache-ttl <integer>
    set cache-notfound-responses {enable | disable}
    set source-ip <class_ip>
end Copy

 

For a FortiGate with multiple logical CPUs, you can set the DNS process number from 1 to the number of logical CPUs.

 

The default DNS process number is 1.

config system global
    set dnsproxy-worker-count <integer>
end

 

dns-over-tls

 

DNS over TLS (DoT) is a security protocol for encrypting and wrapping DNS queries and answers via the Transport Layer Security (TLS) protocol. It can be enabled, disabled, or enforced:

  • disable: Disable DNS over TLS (default).
  • enable: Use TLS for DNS queries if TLS is available.
  • enforce: Use only TLS for DNS queries. Does not fall back to unencrypted DNS queries if TLS is unavailable.

For more information, see DNS over TLS.

 

반응형

cache-notfound-responses

 

When enabled, any DNS requests that are returned with NOT FOUND can be stored in the cache. The DNS server is not asked to resolve the host name for NOT FOUND entries. By default, this option is disabled.

 

dns-cache-limit

Set the number of DNS entries that are stored in the cache (0 to 4294967295, default = 5000). Entries that remain in the cache provide a quicker response to requests than going out to the Internet to get the same information.

 

dns-cache-ttl

The duration that the DNS cache retains information, in seconds (60 to 86400 (1 day), default = 1800).

 

 

[Fortinet] Fortigate CLI Commands - Schedule(스케줄) 생성

 

[Fortinet] Fortigate CLI Commands - Schedule(스케줄) 생성

- Schedule 생성#config vdom #edit Vdom명 #config firewall schedule onetime#edit Schedule_Name - 날짜명으로 생성#set start hh:mm yyyy/mm/dd - 시:분 년/월/일#set end hh:mm yyyy/mm/dd #set expiraion-days Number - 스케줄 만료 전에 이벤

infoofit.tistory.com

 

[Fortinet] Fortigate CLI Commands - Service Port(서비스 포트) 생성

 

[Fortinet] Fortigate CLI Commands - Service Port(서비스 포트) 생성

- Service Port 생성 #config vdom #edit Vdom명 #config firewall service custom#edit Port_Name - 생성시 포트 종류와 포트번호를 같이 맵핑하는 것을 추천#set category General - 일반적인 포트는 General 카테고리에 넣어서

infoofit.tistory.com

반응형