How can I avoid needing a split brain DNS setup with the setup outlined below?
I have what "should" be a pretty basic setup using a Fortigate 200D.
- 'Third leg' setup using a DMZ
- Explicitly defined web proxy for internal users
- Default gateway may be set to this device.
- External DNS for our public facing websites.
Every time I look for or ask about this setup I get a pointed towards this documentation, which inherently implies split brain DNS via different IP addresses for access from internal resources. I'm trying really hard to avoid going back that route.
I'm getting the following response, which makes me think that the traffic wasn't being routed correctly.
403 Forbidden: incorrect proxy service was requested
The logs haven't shown any insight so far. I have also tried a packet capture (both on a shared web server and the Fortigate). They both indicate that the packets are dying within the Fortigate.