Description
This article describes how setting the DNS suffix can be useful when it is required to resolve server names without typing the entire domain name when connected via IPsec Dial-Up or SSL VPN.
Scope
FortiGate.
Solution
This configuration option is not available in the GUI interface, but it can be set using the CLI.
For SSL VPN:
If applied to global settings, all connections will have the following settings applied:
config vpn ssl settings
set dns-suffix example.com
end
It can also be applied to individual SSL VPN portals:
config vpn ssl web portal
edit <portal_name>
set dns-suffix example.com
next
end
If more than one domain suffix is needed for SSL VPN, multiple entries can be added using a semicolon ';' without blank spaces as delimiter:
set dns-suffix example.com;example.org
For IPsec Dial-up VPN:
The available dns suffix options for IPsec VPN change depending on IKE version and firmware. They all require mode-cfg and 'set type dynamic'.
For IKEv1 IPsec VPN, configure default DNS domain:
config vpn ipsec phase1-interface
edit <gateway_name>
set mode-cfg enable
set type dynamic
set ipv4-dns-server1
set ipv6-dns-server1
set unity-support enable <- This needs to be enabled in order to use 'set domain' command.
set domain <domain> <- This sets the default DNS domain for vpn clients.
next
end
FortiOS IKEv2 supports split DNS as per RFC 8598.
IKEv2 does not support Unity extensions, therefore 'set domain' configuration is not available for FortiOS IKEv2. However, IKEv2 split DNS is available in later firmware versions. This is configured in CLI using 'set internal-domain-list'.
Software requirements for IKEv2 split DNS:
- FortiOS v7.2.8, v7.4.1
- FortiClient Windows 7.2.3
- FortiClient Linux 7.2.2
- FortiClient Mac 7.2.4
For IKEv2 IPsec VPN, configure split DNS:
config vpn ipsec phase1-interface
edit <gateway_name>
set mode-cfg enable
set type dynamic
set ipv4-dns-server1
set ipv6-dns-server1
set internal-domain-list <domain_1> <domain_2> ... <domain_n>
next
end
