IPSEC, DNS, IPSEC Remote access
Hello everyone. We bought a Fortigate 71g (7.6.7). I have experience using OpenVPN on Mikrotik and Pfsense. It was very convenient for remote access and local DNS access. The point is, we need to provide remote access to people without providing a DNS domain and server; we bind users by IP addresses, and that was sufficient. The problem is that I can't get the IPSec Fortigate to work without providing clients with a DNS server. All requests start going through the VPN tunnel, and access to local domains and DNS is lost.
Detecting the client's local DNS is not quite right. For example, OpenVPN has this block-outside-dns feature. Is there a solution?
Tried:
1) config vpn ipsec phase1-interface
    edit "test1"
        set dns-mode manual
        set ipv4-dns-server1 0.0.0.0
    next
end
2) I tried unset ipv4-dns-server1,2,3
3) ipsec Mode config - manual
4) in the client's config in XML:Â
        <ipsecvpn>
            <options>
                <enabled>1</enabled>
                <beep_if_error>0</beep_if_error>
                <usewincert>1</usewincert>
                <use_win_current_user_cert>1</use_win_current_user_cert>
                <use_win_local_computer_cert>1</use_win_local_computer_cert>
                <no_dns_registration>1</no_dns_registration>
                <block_ipv6>1</block_ipv6>
                <uselocalcert>0</uselocalcert>
                <usesmcardcert>1</usesmcardcert>
                <enable_udp_checksum>0</enable_udp_checksum>
                <disable_default_route>0</disable_default_route>
                <show_auth_cert_only>0</show_auth_cert_only>
                <disallow_invalid_server_certificate>0</disallow_invalid_server_certificate>
                <check_for_cert_private_key>0</check_for_cert_private_key>
                <enhanced_key_usage_mandatory>0</enhanced_key_usage_mandatory>
                <prefer_ipsecvpn_dns>0</prefer_ipsecvpn_dns>
            </options>
The client config contains the line <block_outside_dns>0</block_outside_dns>, but it doesn't work.
