DDNS

If your external IP address changes regularly and you have a static domain name, you can configure the external interface to use a dynamic DNS (DDNS) service. This ensures that external users and customers can always connect to your company firewall. If you have a FortiGuard subscription, you can use FortiGuard as the DDNS server.

FortiGate does not support DDNS for pure TP mode. FortiGate models 1000D and higher do not support DDNS in the GUI.

You can configure FortiGuard as the DDNS server using the GUI or CLI.

Sample topology

In this example, FortiGuard DDNS is enabled and the DDNS server is set to float-zone.com. Other DDNS server options include fortiddns.com and fortidyndns.com.

To configure FortiGuard as the DDNS server in the GUI:

1. Go to Network > DNS
2. Enable FortiGuard DDNS.
3. Select the Interface with the dynamic connection.
4. Select the Server that you have an account with.
5. Enter your Unique Location.

   

6. Click Apply.

To configure FortiGuard as the DDNS server in the CLI:

config system ddns
    edit 1
        set ddns-server FortiGuardDDNS
        set ddns-domain "branch.float-zone.com"
        set monitor-interface "wan1"
    next
end

DDNS servers other than FortiGuard

If you do not have a FortiGuard subscription, or want to use a different DDNS server, you can configure a DDNS server for each interface. Only the first configure port appears in the GUI. The available commands vary depending on the selected DDNS server.

To configure DDNS servers other than FortiGuard in the CLI:

config system ddns
    edit <DDNS_ID>
        set monitor-interface <external_interface>
        set ddns-server <ddns_server_selection>
        ...
    next
end

Refresh DDNS IP addresses

You can configure FortiGate to refresh DDNS IP addresses. FortiGate periodically checks the DDNS server that is configured.

To configure FortiGate to refresh DDNS IP addresses using the CLI:

config system ddns
    edit 1
        set ddns-server FortiGuardDDNS
        set use-public-ip enable
        set update-interval seconds
    next
end

Disable cleartext

When clear-text is disabled, FortiGate uses the SSL connection to send and receive (DDNS) updates.

To disable cleartext and set the SSL certificate using the CLI:

config system ddns
    edit <1>
        set clear-text disable
        set ssl-certificate <cert_name>
    next
end

DDNS update override

A DHCP server has an override command option that allows DHCP server communications to go through DDNS to perform updates for the DHCP client. This enforces a DDNS update of the A field every time even if the DHCP client does not request it. This allows support for the allow, ignore, and deny client‑updates options.

To enable DDNS update override using the CLI:

config system dhcp server
    edit 1
        set ddns-update enable
        set ddns-update_override enable
        set ddns-server-ip <ddns_server_ip>
        set ddns-zone <ddns_zone>
    next
end

Troubleshooting

To debug DDNS:

# diagnose debug application ddnscd -1
# diagnose debug enable

To check if a DDNS server is available:

# diagnose test application ddnscd 3

Not available:

FortiDDNS status:
ddns_ip=0.0.0.0 ddns_port=443 svr_num=0 domain_num=0

Available:

FortiDDNS status:
ddns_ip=208.91.113.230 ddns_port=443 svr_num=1 domain_num=3
svr[0]= 208.91.113.230
domain[0]= fortiddns.com
domain[1]= fortidyndns.com
domain[2]= float-zone.com