DNS Resolutions across VPN

Forum|Forum|4 years ago
February 8, 2022
4 replies
4851 views

Hey

I have an IPSEC VPN LAN-LAN up and running, but i cant ping other servers on the other side by name....I can only ping by IP.

I tried to follow the tech note below but the command SET DOMAIN is not avaiable on my FORTIGATE 7.0.3
https://community.fortinet.com/t5/FortiGate/Technical-Note-DNS-resolution-over-IPsec-SSL-VPN/ta-p/197018

How can i resolve names across IPSEC VPN?

FortiGate

btan

Staff & Editor

Hi Lmelim,

As per KB: The set domain command will be available only when mode-cfg is enabled.
Hence, you may need to "set mode-cfg enable" first

Refer: https://docs.fortinet.com/document/fortigate/7.0.3/cli-reference/371620/config-vpn-ipsec-phase1-interface

LmelimAuthor

New Member

Hey

even issuing the command SET MODE-CFG ENABLE the SET DOMAIN is not available.
Does this command is only available for remote IPSEC VPN or is available for SITE TO SITE IPSEC vpn?
I cant make it work my DNS resolution..

kcheng

Staff & Editor

The respective configuration only works for Dynamic VPN tunnel. If you are having a Site-to-Site VPN configuration, it is not possible to set the domain. From where do you want to ping the remote site server? If it is FortiGate, you can change the DNS setting in FortiGate, if you are trying to ping from the internal hosts, you can check if it is configured with an internal DNS server that can resolves the server name on the remote network.

LmelimAuthor

New Member

Hey

I found the solution.
It was the DNS Filter activated on the VPN FIREWALL RULE that somehow was blocking DNS response...
once it was disabled, the DNS resolution started to work fine.

Sign up

Login with SSO

Login to the community

Login with SSO