internal URL not resolve of FortiSASE

Hi,

you can't really troubleshoot stuff in FortiSASE like we know from onprem FortiGates.

I would first try to sniff for the DNS traffic, which you should see in the IPsec tunnel to your SPA site.
Then maybe also run a debug to see what's happening with this traffic.

I've heard of a Split DNS issue in new SASE instances which occur if you configured the SPA with BGP on loopback, only support can fix this with a workaround.

KR Fabian

Thank you @fg_muc for your advice. I'll open support case.

Resolved with help of SASE TAC team.. Resolved by 

1. Enable NAT on firewall policy

2. Add tunnel IP to the FW policy