FortiGuard AI-Driven Web Security: Secure DNS Filtering | FortiGuard Security Services

FortiGuard Secure DNS Filtering

Overview This presentation is the second video in a FortiGuard AI-driven web security series, focusing on DNS filtering as a key component of Fortinet's web security service. DNS filtering blocks entire domains and all associated URLs, whereas web filtering blocks specific web pages. The web security subscription comprises web and content filtering, secure DNS, and video filtering.

Key Capabilities and Threats Addressed FortiGuard Secure DNS protects against sophisticated DNS-based threats including DNS tunneling, command-and-control (C&C) server identification, and domain generation algorithms. The service provides full visibility into DNS traffic and can block higher-risk domains including malicious domains, newly registered domains, and parked domains. Users can configure block settings at the DNS level based on various predefined categories.

Technical Implementation FortiGate Next Generation Firewall blocks connections at both DNS and connection levels for comprehensive protection. Starting with FortiOS 7.0, FortiGate can inspect encrypted DNS traffic: DNS over TLS (using TCP port 853) and DNS over HTTPS (using TCP port 443). Configuration is performed through the DNS filter security profile in the FortiGate GUI. Security events and DNS query logs provide visibility into blocked requests and domain categorization.

Practical Use Cases The presentation demonstrates two scenarios: First, a K-8 school environment using DNS filtering for compliance with child protection regulations by blocking categories of inappropriate content. Configuration involves creating a named DNS profile with selected blocked categories and applying it to firewall policies. Second, blocking botnet and C&C domains, with successful blocks visible in DNS query logs.

Pre-configured Filters Desktop FortiGate models (such as the FortiGate 40F) include pre-configured filters resembling movie ratings: G (all ages, strictest), PG-13 (more lenient), and R (most lenient), with custom filter options. These simplify profile creation for environments with child and teenage users.

Key Differentiation Fortinet includes DNS protection as part of the web security subscription, whereas some competitors offer DNS protection as a separate service.