Skip to main content
Patrick3
Patrick3
New Member
September 9, 2013
Question

FortiClient 5.0.4 Mac OSX and DNS Suffix

  • September 9, 2013
  • 4 replies
  • 9964 views
Hello, It appears that the FortiClient 5.0.4 for Mac OSX does not properly pull down and apply the DNS search suffix settings configured on the Fortigate 100D firewall. Our windows clients are pulling the dns search settings fine but not the macs. I called tech support but the Fortinet rep said it was an issue with Mac OSX. I don' t think it is an issue with OSX as it was working with one of the other 5.0.x firmware versions on the firewall. Anyone else have any feedback on this problem? Kind regards,

    4 replies

    kolawale_FTNT
    Staff
    kolawale_FTNT
    Staff
    September 9, 2013
    Please explain how FortiClient is related to the DNS settings. Are you connecting to the FortiGate using VPN? If yes, please provide both the FortiOS and the FortiClient configuration files. If not connecting by VPN, explain how it was determined that the issue you posted is caused by FortiClient. If you shutdown FortiClient on the Mac OS X client, would the DNS settings correctly received?
    Patrick3
    Patrick3Author
    New Member
    September 10, 2013
    Yes, this is specifically regarding users connecting via the SSL VPN client / portal. The DNS servers and domain suffix search settings are pushed to the client in windows but in osx the dns search suffix never gets pushed. I' ll try and post the configs later but keep in mind that the config works fine for windows and that Fortinet support people said the config on the firewall is ok.
    emnoc
    emnoc
    New Member
    September 10, 2013
    I will check on my unit, but don' t recall anything being pushed either to the MACOSX. I will post whatever I find later.
    emnoc
    emnoc
    New Member
    September 11, 2013
    MACOSX lion, no go either. # # This file is automatically generated. # nameserver 8.8.8.8 nameserver 8.8.4.4 # # Mac OS X Notice # # This file is not used by the host name and address resolution # or the DNS query routing mechanisms used by most processes on # this Mac OS X system. # # This file is automatically generated. # I even change stuff around and re-tried nameserver 8.8.7.7 nameserver 8.8.4.4 cat /etc/resolv.conf # # Mac OS X Notice # # This file is not used by the host name and address resolution # or the DNS query routing mechanisms used by most processes on # this Mac OS X system. # # This file is automatically generated. # domain ##### nameserver ####### nameserver ####### nameserver ####### And the config used; config vpn ssl settings set dns-server1 8.8.8.8 set dns-server2 8.8.4.4 set tunnel-ip-pools " SSLVPN_TUNNEL_ADDR1" set tunnel-ipv6-pools " SSLVPNpool1" set dns-suffix " example.com" set ipv6-dns-server1 2001:4860:4860::8888 set ipv6-dns-server2 2001:4860:4860::8844 end forticlient used;
    kolawale_FTNT
    Staff
    kolawale_FTNT
    Staff
    September 12, 2013
    emnoc, When using: 
        set dns-suffix " example.com"
    in your FortiOS configuration, did you find that, after FortiClient has established an SSL VPN connection, you were able to ping a name in that domain? For instance, 
        ping mail
    gets resolved to mail.example.com? Is " example.com" included in the output of the command " scutil --dns" on your Mac OS X?
    Terms & ConditionsAccessibility statement