Technical Tip: FortiClient IPsec VPN - How to configure DNS suffix search list

Description

This article describes how to configure the DNS suffix search list on a FortiClient EMS server.

  Scope

FortiClient EMS v7.4.x, Windows FortiClient v7.4.4+.

Solution

The DNS suffix search list can be configured on the FortiClient EMS side without making any changes on the FortiGate device.

Go to Endpoint Profiles -> Remote Access. Select the profile that requires a DNS suffix search list configured, and select Edit.

Select the XML button to edit the XML configuration file.

Add the following line under the desired VPN tunnel:

<dns_suffix_list>vpn.example.com,sub.vpn.example.com,vp2.example.com</dns_suffix_list>

This tag depends on <prefer_ipsecvpn_dns>. When <prefer_ipsecvpn_dns> = 1 (enabled), all entries in <dns_suffix_list> are appended to the global DNS suffix search list. Windows will try the suffixes in the configured order until one resolves.

When <prefer_ipsecvpn_dns> = 0 (disabled), only one suffix is supported. That single entry is applied as the connection-specific DNS suffix on the IKEv2 virtual adapter. Additional entries, if present, are ignored.

Note:

A DNS suffix search list can also be configured on the FortiGate side, but there are limitations to take into account.

DNS suffix search list configuration is natively supported for IKE version 1. Only one DNS suffix is configurable per IPsec tunnel.

Starting FortiOS v7.6.4+, for IKE version 2, DNS suffix is supported when connecting from a Windows FortiClient running v7.4.4 or later. More than one DNS suffix can be configured per IPsec tunnel.

If both FortiOS and EMS provide suffix lists, the FortiOS list takes precedence.

See IPsec DNS suffix for FortiGate devices.