FortiDDNS connectivity issues on FortiGate: field-tested workaround

Intermediate2 min read

Prerequisites: FortiGate administration, DNS and basic CLI troubleshooting.

Many FortiGate administrators are facing FortiDDNS connectivity issues, including failures when creating or updating FortiDDNS entries through the GUI. Based on field testing, the issue has been observed across different FortiGate models and FortiOS releases from 7.0.x through 7.4.12. In one tested upgrade path, the issue continued after upgrading from FortiOS 7.0.2 to 7.4.12.

Fortinet TAC is still investigating the underlying issue. The following combined procedure is a field-tested workaround that resolved the problem in the tested environment.

Observed symptoms

• FortiDDNS cannot be created or edited reliably through the GUI.
• FortiGuard DDNS connectivity fails or does not complete.
• Certificate-related errors may appear during FortiGuard communication.
• The FortiDDNS hostname does not resolve or update as expected.

Workaround

Step 1: Create the FortiDDNS entry through the CLI

When the GUI does not create the entry successfully, configure it from the CLI. Replace the example hostname and interface with your values.

config system ddns
edit 1
set ddns-server FortiGuardDDNS
set server-type ipv4
set ddns-domain "yourname.fortiddns.com"
set addr-type ipv4
set use-public-ip enable
set monitor-interface "wan1"
next
end

Step 2: Disable FortiGuard Anycast and specify the DDNS server

Configure the FortiGuard settings as follows:

config system fortiguard
set anycast disable
set ddns-server-ip 173.243.138.226
end

Step 3: Import the DigiCert trusted root CA

Download the DigiCert High Assurance EV Root CA from the official DigiCert source. Verify the certificate fingerprint before importing it. Import the certificate into the FortiGate as a trusted CA certificate; do not import it as a local identity certificate.

Verification checklist

1. Confirm that the FortiDDNS entry appears in the FortiGate configuration.
2. Confirm that the configured WAN interface is available and has Internet connectivity.
3. Verify that the FortiDDNS hostname resolves to the expected public IP address.
4. Confirm that the FortiDDNS status updates after an interface or public-IP change.
5. Review FortiGate event and system logs for remaining FortiGuard or certificate errors.
6. Test access using the FortiDDNS hostname from an external network.

Operational notes

Apply the change during an approved maintenance window. Back up the FortiGate configuration before modifying FortiGuard or certificate settings. Use the exact FortiOS syntax supported by your model and release. The IP address and commands above should be validated against your environment and current Fortinet guidance before production deployment.

This workaround resolved the FortiDDNS connectivity issue in the tested environment while the root cause remains under Fortinet investigation.

For assistance with this FortiDDNS troubleshooting procedure, contact:

support@networkguard360.com