DNS for non domain devices over VPN

Forum|Forum|3 years ago
March 8, 2023
4 replies
2546 views

Have a hub and spoke VPN setup with DNS on hub network. Spoke network domain devices are provisioned by DHCP with our DNS. Any domain joined device can resolve DNS without issue. I have some android devices on the spoke side which will not resolve. The devices work perfectly when on the Hub side of the VPN. Any suggestions how I could force these to resolve?

FortiGate

adambomb1219

SuperUser

That's interesting, can the Android Devices ping the DNS server? Are they assigned a different subnet on the firewall than the domain joined devices? Are you using Identity based rules that the Android devices wouldn't match? Do you see the correct DNS server on the Android device after DHCP has occurred?

KML100Author

New Member

Replying to all your questions

Android Devices ping the DNS server? Yes by IP

Are they assigned a different subnet on the firewall than the domain joined devices? No same subnet

Are you using Identity based rules that the Android devices wouldn't match? No

Do you see the correct DNS server on the Android device after DHCP has occurred? Yes, working perfectly by IP only.

KML100Author

New Member

I can hit everything by IP. But domain names do not resolve.

Olivia_7

New Member

you need to specify which DNS servers that the clients receive when they are allocated their VPN IP address when they connect

KML100Author

New Member

The DNS servers are my local domain DNS on my hub network. I have tested the same devices with this DNS configuration without the IPSEC VPN and they work.

srajeswaran

Staff

Android------Spoke-FW---------IPSecVPN---------Hub-FW-------DNS-Server

I assume this is the simple topology, can you run a sniffer on Hub FW and confirm if the DNS requests are reaching the Hub-FW or DNS-Server via VPN

Sign up

Login with SSO

Login to the community

Login with SSO