Staff

Technical Tip: Dissolvable agent prompts for server name during VPN registration

Forum|Forum|5 years ago
May 3, 2021
0 replies
580 views

Description

This article explains the Dissolvable Agent prompt to enter the server name during VPN registration. This can occur if the agent is unable to locate the appliance due to a domain mismatch.

diss search.PNG

During connection, the agent sends SRV DNS requests (queries) to determine the name of the appliance. SRV queries are answered if they are sourced from the same domain as the appliance VPN interface. If different, the agent will be unable to determine the appliance name, and agent communication will fail. Therefore, if FortiNAC is managing multiple VPN scopes, they must all use the same domain.

Scope

FortiNAC.

Solution

While connected to the VPN tunnel, confirm that the host's DNS Suffix Search list includes the domain configured in the VPN DHCP scope on the appliance.

For Windows, run the following command from CMD or PowerShell:

ipconfig/all

For macOS and Linux hosts, check this configuration file:

cat /etc/resolv.conf

The host requests can also be checked on the 'named.log' file on FortiNAC. Review the '/bsc/logs/named.log' file for SRV queries sent from the VPN host to the FortiNAC appliance.

For integration with Cisco ASA, the 'default-domain value' should match the domain specified in the FortiNAC VPN DHCP scope.

default-domain value <domain in VPN DHCP scope>

For details, see this document: Cisco ASA VPN Integration.

For integration with FortiGate VPN, the 'dns-suffix' value should match the domain specified in the FortiNAC VPN DHCP scope.

config vpn ssl web portal
edit "FNAC_SSL_Portal"
set dns-suffix "<domain in VPN DHCP scope>"

For details, see this document: FortiGate VPN Device Integration.

Related articles:

Technical Tip: Agent DNS records (SRV) and checks on Microsoft environment

Technical Tip: A simple network example of deploying VPN management with FortiGate

Technical Tip: Troubleshooting FortiGate VPN integrations

Technical Tip: Troubleshooting Cisco ASA VPN integrations