Skip to main content
tim5700
tim5700
New Member
November 20, 2015
Question

Painfully slow DNS resolution when connected

  • November 20, 2015
  • 1 reply
  • 8837 views

Fortigate model is 1500D, running on 5.2.3 with the matching SSLVPN client.

 

Due to the nature of our environment, we have multiple AD domains behind the firewall.  Each "domain" has its own SSL VPN Portal, where when connected users they get assigned an IP address from a unique pool designated for them.  They are also assigned DNS servers from their domain.

 

But because when it comes to DNS Suffix settings being system wide only, everyone is assigned a list of 5 DNS suffixes to search.

 

As a result, when users connect and try to resolve a single host name, the DNS resolution process takes more than 15 seconds.  Part of this is because it looks like their computer (Win7 - Win10) are trying to resolve using the DNS server assigned to their NIC first.

 

Is there any way to do DNS suffixes per VPN portal?  Is there any to use the VPN assigned DNS server exclusively while connect?  Any suggestions on how to speed this up?

1 reply

gschmitt
gschmitt
New Member
November 20, 2015

tim5700 wrote:

Part of this is because it looks like their computer (Win7 - Win10) are trying to resolve using the DNS server assigned to their NIC first.

 

BS,

Windows 10 uses DNS Multicast which leads to DNS leaks.

tim5700
tim5700Author
New Member
November 20, 2015

That's an excellent thought.

 

But how does that explain the Win7 & 8.x clients?

tim5700
tim5700Author
New Member
November 20, 2015

Disabling Multicast Name Resolution doesn't seem to help.

Terms & ConditionsAccessibility statement