Issue with DERP and Fortinet

### What is the issue?

Hi
We have multiple sites that have Fortigate firewalls
We see an issue with the connection, I did a troubleshooting session, and from what we understand, the issue is

In summary, the endpoint - in the case the Lynxight server, must make a DNS query for the FQDN that the server needs to reach and that query must pass through the FortiGate so that the IP address contained within the DNS response can be added to the FortiGate cache relating to the *.[tailscale.com](http://tailscale.com/) address object

At the moment, i can see many denies in the logs to various DERP destinations relating to tailscale. This suggests that the tailscale application is not making a DNS query to determine the IP addresses of these FQDN's

If i then force the FortiGate itself to do a ping which requires a DNS resolution for [derp15d.tailscale.com](http://derp15d.tailscale.com/) (the ping fails but ignore this as the server may not respond to pings)

[derp15d.tailscale.com](http://derp15d.tailscale.com/) then gets added to the FortiGate's cache for the *.[tailscale.com](http://tailscale.com/) object


We then see traffic begin to pass between the server - although this is because i had previously tested with a ping to another DERP FQDN for [derp4f.tailscale.com](http://derp4f.tailscale.com/) which was previously being denied and then began being permitted because it was added to the cache

### Steps to reproduce

_No response_

### Are there any recent changes that introduced the issue?

_No response_

### OS

Linux

### OS version

Ubuntu 22.04

### Tailscale version

_No response_

### Other software

Fortigate

### Bug report

BUG-89c1b91fb7f234e75e3cc22d2d5049a518ae3c442f581d044f65a6a298521f55-20250305150005Z-61c6cdea73d50040