Visitor III

Solved

DNS Reply problem on VPN SSL

Forum|Forum|2 years ago
May 9, 2024
6 replies
4925 views

Hi

I have a problem with vpn client and fortigate.

The tunnel is up ping device is ok but when i ping fqdn host no response.

Split tunnel is enabled. do you have an idea.

Fortigate and VPN version 7.4.3

Thanks for your help

SSL-VPN

Best answer by Meni

I found problem description ...

https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-Issues-with-resolving-the-internal-FQDN-when/ta-p/291062

AEK

SuperUser

Hi Meni

Try configure slit DNS

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/988717/ssl-vpn-split-dns

AEK

MeniAuthor

Visitor III

Hi Aek
thank you for your reply. I've done this before and the result is the same.
No DNS resolution

Meni

AEK

SuperUser

Hi Meni

Ensure that there is a firewall policy allowing your VPN clients to send DNS queries to your internal DNS server.

If this is done and doesn't work yet, try the following:

From the client use nslookup to send a DNS query to internald DNS server and see if you got a reply
On FG use diag sniffer (example below) to check if DNS traffic is reaching the FG and properly forwarded
On FG use diad debug flow (example below) to check if this DNS traffic is allowed or blocked by FG

sniffer example

diag sniffer traffic any 'host x.x.x.x and port 53' 4

flow debug example

diag debug flow filter addr x.x.x.x
diag debug flow filter port 53
diag debug flow show function-name enable
diag debug flow show iprope enable
diag debug console timestamp enable
diag debug flow trace start 50
diag debug enable

Where x.x.x.x is the SSL VPN client's IP address, usually 10.212.134.x.

AEK

MeniAuthor

Visitor III

Hi

Thanks for your message. I made test

SSL VPN Client is 192.168.226.101

DNS SERVER : 192.168.1.201

FW01 # diag sniffer packet any 'host 192.168.226.101 and port 53' 4 interfaces=[any] filters=[host 192.168.226.101 and port 53] 15.314038 ssl.root in 192.168.226.101.58481 ->  192.168.1.201.53: udp 39 15.314085 Lan_Inside out 192.168.226.101.58481 ->  192.168.1.201.53: udp 39 15.314089 LAN_Interne out 192.168.226.101.58481 ->  192.168.1.201.53: udp 39 15.314093 port1 out 192.168.226.101.58481 ->  192.168.1.201.53: udp 39 15.314526 Lan_Inside in  192.168.1.201.53 -> 192.168.226.101.58481: udp 55 15.314569 ssl.root out  192.168.1.201.53 -> 192.168.226.101.58481: udp 55 85.046123 ssl.root in 192.168.226.101.55970 ->  192.168.1.201.53: udp 33 85.046176 Lan_Inside out 192.168.226.101.55970 ->  192.168.1.201.53: udp 33 85.046180 LAN_Interne out 192.168.226.101.55970 ->  192.168.1.201.53: udp 33 85.046184 port3 out 192.168.226.101.55970 ->  192.168.1.201.53: udp 33 85.059475 Lan_Inside in  192.168.1.201.53 -> 192.168.226.101.55970: udp 49 85.059501 ssl.root out  192.168.1.201.53 -> 192.168.226.101.55970: udp 49

FW01 # 2024-05-10 10:37:30 id=65308 trace_id=11 func=print_pkt_detail line=5836 msg="vd-root:0 received a packet(proto=17, 192.168.226.101:54790-> 192.168.1.201:53) tun_id=0.0.0.0 from ssl.root. " 2024-05-10 10:37:30 id=65308 trace_id=11 func=init_ip_session_common line=6020 msg="allocate a new session-0024ba0d" 2024-05-10 10:37:30 id=65308 trace_id=11 func=iprope_dnat_check line=5466 msg="in-[ssl.root], out-[]" 2024-05-10 10:37:30 id=65308 trace_id=11 func=iprope_dnat_tree_check line=834 msg="len=0" 2024-05-10 10:37:30 id=65308 trace_id=11 func=iprope_dnat_check line=5487 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000" 2024-05-10 10:37:30 id=65308 trace_id=11 func=vf_ip_route_input_common line=2612 msg="find a route: flag=04000000 gw- 192.168.1.201 via Lan_Inside" 2024-05-10 10:37:30 id=65308 trace_id=11 func=__iprope_fwd_check line=801 msg="in-[ssl.root], out-[Lan_Inside], skb_flags-02000000, vid-0, app_id: 0, url_cat_id: 0" 2024-05-10 10:37:30 id=65308 trace_id=11 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=98, len=3" 2024-05-10 10:37:30 id=65308 trace_id=11 func=__iprope_check_one_policy line=2124 msg="checked gnum-100004 policy-111, ret-no-match, act-accept" 2024-05-10 10:37:30 id=65308 trace_id=11 func=__iprope_check_one_policy line=2124 msg="checked gnum-100004 policy-121, ret-matched, act-accept" 2024-05-10 10:37:30 id=65308 trace_id=11 func=__iprope_user_identity_check line=1887 msg="ret-matched" 2024-05-10 10:37:30 id=65308 trace_id=11 func=__iprope_check line=2388 msg="gnum-4e20, check-ffffffbffc02c384" 2024-05-10 10:37:30 id=65308 trace_id=11 func=__iprope_check_one_policy line=2124 msg="checked gnum-4e20 policy-6, ret-no-match, act-accept" 2024-05-10 10:37:30 id=65308 trace_id=11 func=__iprope_check_one_policy line=2124 msg="checked gnum-4e20 policy-6, ret-no-match, act-accept" 2024-05-10 10:37:30 id=65308 trace_id=11 func=__iprope_check_one_policy line=2124 msg="checked gnum-4e20 policy-6, ret-no-match, act-accept" 2024-05-10 10:37:30 id=65308 trace_id=11 func=__iprope_check line=2405 msg="gnum-4e20 check result: ret-no-match, act-accept, flag-00000000, flag2-00000000" 2024-05-10 10:37:30 id=65308 trace_id=11 func=__iprope_check_one_policy line=2358 msg="policy-121 is matched, act-accept" 2024-05-10 10:37:30 id=65308 trace_id=11 func=__iprope_fwd_check line=838 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-121" 2024-05-10 10:37:30 id=65308 trace_id=11 func=iprope_fwd_auth_check line=867 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-121" 2024-05-10 10:37:30 id=65308 trace_id=11 func=fw_forward_handler line=985 msg="Allowed by Policy-121:" 2024-05-10 10:37:30 id=65308 trace_id=11 func=__ip_session_run_tuple line=3465 msg="run helper-dns-udp(dir=original)" 2024-05-10 10:37:30 id=65308 trace_id=12 func=print_pkt_detail line=5836 msg="vd-root:0 received a packet(proto=17,  192.168.1.201:53->192.168.226.101:54790) tun_id=0.0.0.0 from Lan_Inside. " 2024-05-10 10:37:30 id=65308 trace_id=12 func=resolve_ip_tuple_fast line=5924 msg="Find an existing session, id-0024ba0d, reply direction" 2024-05-10 10:37:30 id=65308 trace_id=12 func=vf_ip_route_input_common line=2612 msg="find a route: flag=04000000 gw-192.168.226.101 via ssl.root" 2024-05-10 10:37:30 id=65308 trace_id=12 func=npu_nturbo_unset_flags line=272 msg="ses->npu_state=0x100 skb->npu_flag=0x0" 2024-05-10 10:37:30 id=65308 trace_id=12 func=npu_nturbo_unset_flags line=272 msg="ses->npu_state=0x40108 skb->npu_flag=0x0" 2024-05-10 10:37:30 id=65308 trace_id=12 func=npu_handle_session44 line=1213 msg="Trying to offloading session from Lan_Inside to ssl.root, skb.npu_flag=00000000 ses.state=01000200 ses.npu_state=0x00040108" 2024-05-10 10:37:30 id=65308 trace_id=12 func=fw_forward_dirty_handler line=447 msg="state=01000200, state2=00000000, npu_state=00040108" 2024-05-10 10:37:30 id=65308 trace_id=12 func=__iprope_check line=2388 msg="gnum-100008, check-ffffffbffc02c130" 2024-05-10 10:37:30 id=65308 trace_id=12 func=iprope_policy_group_check line=4884 msg="after check: ret-no-match, act-drop, flag-00000000, flag2-00000000" 2024-05-10 10:37:30 id=65308 trace_id=12 func=__ip_session_run_tuple line=3465 msg="run helper-dns-udp(dir=reply)"

I don't see error.

smayank

Staff

Hello Meni

You can check for few things
If you are pinging FQDN which is hosted internally then check if you have configured DNS server in SSL settings
The second condition is if you have configured DNS in SSL settings and you are resolving public DNS it might not work because DNS settings pushed to all the adapters

you can also check if if fqdn is fully qualified domain name or just a hostname

Thanks & Regards
Mayank Sharma

MeniAuthor

Visitor III

Hi Mayank

Thanks for your reply

I only put internal DNS. See below

Capture d'écran 2024-05-10 143659.png

The result is the same whether pinging the host alone or with the local domain

hbac

Staff

Hi @Meni,

Do you have a firewall policy to allow traffic from VPN clients to DNS servers?

Regards,

MeniAuthor

Visitor III

Hi @hbac

Thanks for your reply

Yes i have it.

Capture d'écran 2024-05-10 145741.png

I don't use ipV6 DNS, could the problem come from

Regards

Meni

AEK

SuperUser

Just for troubleshooting purpose, try enable NAT on this policy and redo the test.

AEK

MeniAuthor

Visitor III

Hi

if I disable IPV6 stack on the client the DNS resolution works correctly

I search a solution without ipV6 desactivation

MeniAuthorAnswer

Visitor III

I found problem description ...

https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-Issues-with-resolving-the-internal-FQDN-when/ta-p/291062

AEK

SuperUser

Thanks for sharing, Meni

AEK

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded