Skip to main content
Magion
Magion
New Member
April 15, 2020
Question

Split DNS

  • April 15, 2020
  • 2 replies
  • 24485 views

I configured sslvpn with split-tunneling and split-dns. Split-tunneling works fine, but split-dns not. It looks like all dns requests are sent to the remote dns, instead of only the specified domains.

 

config split-dns
    edit 1
        set domains "domain.com,sub.domain.com"
        set dns-server1 192.168.100.10
        set dns-server2 192.168.100.20
    next
end

 

Resolving hosts on the remote network is fine, however local dns names are not working. Drive mappings on my client time out after a while (probably dns record ttl) and are inaccessible, rdp and web no longer are able to connect to local resources unless I use IP addresses.

 

My client is on a local network with it's own dns servers, and like to keep access to local resources.

All local resources are available though, so split-tunneling is ok.

 

Using dnslookup for local network entries does work, however that's because it connects to the local dns server using ip.

2 replies

Dave_Hall
Dave_Hall
New Member
April 15, 2020

is dns-suffix set?

 

config vpn ssl settings set dns-suffix XXXXXXX end

Magion
MagionAuthor
New Member
April 15, 2020

I tested both with and without dns-suffix. Doesn't make a difference.

(only difference with above example is that I set the dns-suffix in the portal configuration instead of sslvpn global settings)

Magion
MagionAuthor
New Member
April 15, 2020

From the online help:

If the domain does not match split-dns then the FortiClient network driver will respond to the DNS request with "no such name" forcing the DNS request to be resolved by the physical adapter DNS.

 

If I define a domain on the FortiGate configuration which is different from my local domain, the FortiClient network driver should never let the resolving happen on the FortiGate.

 

My domain has split-brain dns with different internal and external dns servers. Maybe this will somehow confuse the FortiClient network driver?

 

 

 

sw2090
SuperUser
sw2090
SuperUser
August 24, 2020

I ran into this too during configuring ipsec tunnels for homeoffice here. I found that split dns will only work this way: you can set dns server(s) and domain via gui (or FMG gui if you have and prefer). This is what you already have done. You still must set dns mode to manual and for unknown reasons Fortinet did not include this option in gui (on FMG it is in gui somewhere in the advanced settings of the ipsec phase). Also it is not shown in cli as long as it has the default value. Default value for dns mode is auto or something like that. With this the Tunnel will not do split dns. Once you set dns mode to manual (and maybe reconnect your vpn client afterwards) it shoud work. It did so here...

Magion
MagionAuthor
New Member
August 24, 2020

Thanks, however it looks like dns-mode is a ipsec only command. We're using sslvpn.

 

Magion
MagionAuthor
New Member
August 24, 2020

https://kb.fortinet.com/kb/documentLink.do?externalID=FD48421 describes exactly what I need... if only it would work

 

Unfortunately I'm unable to proceed with support since I don't have a EMS/FCT license. Apparently they also do not accept bug reports for free software... too bad.

Terms & ConditionsAccessibility statement