config global-dns-server tsig-key

Use this command to manage TSIG (Transaction SIGnature) keys for DNS zone transfers and NOTIFY authentication. TSIG keys are shared secrets used to verify the integrity and authenticity of DNS synchronization traffic between FortiADC and external DNS servers.

TSIG keys cannot be created manually. They are imported either through the GUI (Global Load Balance > Zone Tools > TSIG Key) or by importing a key file in the CLI. When a key file is imported, FortiADC automatically generates the corresponding entry in this table. This command allows administrators to view or reference imported keys, and, if necessary, import them directly through the CLI.

Keys that are in use by any zone cannot be deleted. Removing a TSIG key entry also deletes the underlying file from the system.

Syntax

config global-dns-server tsig-key
    edit <name>
        set filename <string>
        set algorithm {hmac-md5 | hmac-sha1 | hmac-sha224 | hmac-sha256 | hmac-sha384 | hmac-sha512}
        set secret <string>
    next
end

<name>	Unique identifier for the TSIG key entry. Usually corresponds to the imported file name.
filename	Filename of the imported TSIG key.
algorithm	Cryptographic algorithm associated with the key. Supported values: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, hmac-sha512.
secret	Shared secret string used for TSIG authentication.

Example

config global-dns-server tsig-key
    edit "183_185"
        set filename "183_185"
        set algorithm hmac-sha256
        set secret "5GSCgrwjBhvCBkWF5320BRa0l+unv/Zw2SBi4N0pRrc="
    next
end