Unable to resolve hostname

Forum|Forum|6 years ago
March 25, 2020
3 replies
50985 views

I'm having trouble getting one of my Fortigate 200Es to be able to resolve hostnames.

If the system DNS servers are set to use the Fortinet servers (or any other external DNS servers), I'm unable to resolve any host names.

If I set the system DNS servers to our internal ones, I can resolve the host names but PING still fails.

Any ideas what I should check to get this resolved?

Thanks,

Wilson

rwpatterson

New Member

You have two different issues. Using your own DNS solved the resolution issue. Next is the reachability. Do you have a policy from A-B with ICMP enabled? (or 'ANY')

TecnetRuss

Visitor III

Are you trying to ping the short name (e.g. server1) or the long name/FQDN (e.g. server1.domain.local)?

If you're only having trouble with short name resolution keep in mind that short names will only resolve if you have correct default DNS suffix configured.

On the FortiGate itself this is set under Network / DNS in the Local Domain Name field right below where you've set your internal DNS server IP addresses.

If you're finding that VPN clients can't resolve internal server names (short names) properly and network drives don't map correctly, etc. even with your internal DNS servers set correctly in the IPSec or SSL-VPN tunnel configuration, check that the DNS suffix is set correctly as follows:

[ul]

If you're using IPSec Remote Access: config vpn ipsec phase1-interface show edit <VPN-dial-up-interface-name> set domain <internal-domain-suffix> (e.g. domain.local) end

If you're using SSL-VPN Remote Access: config vpn ssl settings set dns-suffix <internal-domain-suffix> (e.g. domain.local) end[/ul]

Russ

NSE7

KC_Cheong

New Member

TecnetRuss wrote:
Are you trying to ping the short name (e.g. server1) or the long name/FQDN (e.g. server1.domain.local)?

If you're only having trouble with short name resolution keep in mind that short names will only resolve if you have correct default DNS suffix configured.

On the FortiGate itself this is set under Network / DNS in the Local Domain Name field right below where you've set your internal DNS server IP addresses.

If you're finding that VPN clients can't resolve internal server names (short names) properly and network drives don't map correctly, etc. even with your internal DNS servers set correctly in the IPSec or SSL-VPN tunnel configuration, check that the DNS suffix is set correctly as follows:
[ul]
If you're using IPSec Remote Access: config vpn ipsec phase1-interface show edit <VPN-dial-up-interface-name> set domain <internal-domain-suffix> (e.g. domain.local) end
If you're using SSL-VPN Remote Access: config vpn ssl settings set dns-suffix <internal-domain-suffix> (e.g. domain.local) end[/ul]
Russ
NSE7

These steps worked if in domain environment but not in a workgroup environment. Is there some other steps for vpn ipsec and ssl-vpn to do for workgroup computers as pinging their IP is ok but not the computer name.

Thanks.

sw2090

SuperUser

if the FGT cannot reach the fortinet servers that might mean it has no route to the internet itself.

I'd check if you have a default route set up on the fgt in network->static routes.

That would also explain what you further described:

using you internal DNS works => FGT has an interface in that subnet - so there is a connected route to there so it can reach the internal dns and they do resolve. Still without default route on the FGT itself you cannot ping because that ICMP Echo would go to the internet.

It would then only work for internal hosts that your internal dns can resolve.