DNS lookup failed.

Hi,

Thank you for using the Community. 
As per the query, I understand that the SSL VPN connection works just fine, but you observed the 'DNS lookup failed' on the browser, am I correct?

Best,
Irfan

Hey sistemastda,

can you clarify what kind of error message you get? DNS error is a bit broad.

Can you perhaps share a screenshot of your bookmark configuration as well?

If you set the bookmark with an FQDN (server/test), can FortiGate resolve this?

Hello,

The problem is that when I try to access a shared resource or a shared directory it does not let me access either with the user or domain user. It gives a DNS Lookup Failed error. I also tried to put the IP of the server and also gives the same error. How can I debug to resolve the issue.

Thanks

Just cut to the chase and use the built in packet capture utility or even better use the flow debug application to quickly see what the traffic is doing. Learn how to do this and you Fortigate troubleshooting just went into overdrive, guarantee it!

diag debug reset
diag debug flow filter clear
diag debug flow filter saddr {Your.IP} but do not include the {}
diag debug flow filter port 80
diag debug flow show console enable
diag debug flow show iprope enable
diag debug flow show function-name enable
diag debug console timestamp enable
diag debug enable
diag debug flow trace start 1000

• (You can also use the resource or destination address with the command: diag debug flow filter daddr IP.of.Remote.Resource)
• (You can also look for only the address (not SRC or DST) with: diag debug flow filter addr {Whatever.IP.You.Want} Leave off {}
• (You can also look for only DNS queries: {diag debug flow filter port 443} Again - no {})

Once you capture the flows be sure and run:

diag debug reset

diag debug disable

Look through the data for the problem. If it were me and the system was not too busy I'd probably just look at the port 53 traffic but it will take some tweaking to get it just right for your application. It will tell you the issue but if you're not sure post back here and someone will decipher for you.

This could also prove helpful

diag sniffer packet any 'port 53' 4 999 l

OR

diag sniffer packet any 'ip.of.ssl.client' 4 999 l

OR

diag sniffer packet any 'ip.of.remote.resource' 4 999 l

(note that you DO need the ' and ' in the packet capture application but the 999 and l (that's an L to show the local time) are not required but it's the way I run PCAP's and I run about 10 to 15 a week, easily that many.)