Technical Tip: How to configure DNS suffix for SSL VPN and IPsec VPN on FortiGate

[gmanea]

Description

This article describes how to configure a DNS suffix can simplify name resolution by allowing users connected through IPsec dial-up or SSL VPN to access servers without entering the full domain name. For example, users can connect to a server using server123 instead of server123.example.com.

Scope

FortiGate.

Solution

DNS suffix configuration is supported only via the CLI and is not available in the GUI.

For SSL VPN:

If applied to global settings, all connections will have the following settings applied:

config vpn ssl settings

    set dns-suffix example.com

end

For VDOM-enabled FortiGate:

config vdom

    edit <vdom name>

        config vpn ssl settings

      set dns-suffix example.com

end

It can also be applied to individual SSL VPN portals:

config vpn ssl web portal

    edit <portal_name>

        set dns-suffix example.com
    next

end

For VDOM-enabled FortiGate:

config vdom

    edit <vdom name>

        config vpn ssl web portal

            set dns-suffix example.com

end

If more than one domain suffix is needed for SSL VPN, multiple entries can be added using a semicolon ';' without blank spaces as a delimiter:

set dns-suffix example.com;example.org

IPsec Dial-up VPN:

Starting from FortiOS v7.6.4 and v8.0.0, the DNS suffix option is available in the IPsec VPN phase1 configuration when the type is set to dynamic and mode-cfg is enabled.

IKEv1 IPsec VPN:
Configure the default DNS domain:

config vpn ipsec phase1-interface

    edit <tunnel_name>

        set mode-cfg enable

        set type dynamic

        set ipv4-dns-server1

        set ipv6-dns-server1

        set unity-support enable                   <----- This needs to be enabled to use the 'set domain' command.

        set domain example.com                     <----- This sets the default DNS domain for VPN clients.
    next

end

For VDOM-enabled FortiGate:

config vdom

    edit <vdom name>

        config vpn ipsec phase1-interface

         edit <tunnel_name>

             set mode-cfg enable

             set type dynamic

             set ipv4-dns-server1

             set ipv6-dns-server1

             set unity-support enable           <----- This needs to be enabled to use the 'set domain' command.

             set domain example.com             <----- This sets the default DNS domain for VPN clients.

            next

        end

    next

end

Note regarding DNS Suffixes for IPsec tunnels:

IKEv1 only supports assigning a single DNS suffix/domain (no support for multiple domains). The 'unity-support' must be enabled, as this feature will push the DNS suffix to the client end.

IKEv2 IPsec VPN (requires FortiOS v7.6.4, v8.0.0 or later and FortiClient Windows v7.4.4 or later):

Configure one or more default DNS domains:

config vpn ipsec phase1-interface

    edit <tunnel_name>

        set mode-cfg enable

        set ike-version 2

        set type dynamic

        set ipv4-dns-server1

        set ipv6-dns-server1

        set dns-suffix-search example.com        <----- This sets the default DNS domain for VPN clients.
    next

end

For VDOM-enabled FortiGate:

config vdom

    edit <vdom name>

        config vpn ipsec phase1-interface

         edit <tunnel_name>

             set mode-cfg enable

             set ike-version 2

             set type dynamic

             set ipv4-dns-server1

             set ipv6-dns-server1

             set dns-suffix-search example.com         <----- This sets the default DNS domain for VPN clients.

            next

        end

IKEv2 supports assigning multiple DNS suffixes/domains. They must be separated by a space.

set dns-suffix-search example1.com example2.com example3.com

Note: 
If the command 'internal-domain-list' is previously set under phase 1, the command 'dns-suffix-search' will not be available. It is required to remove the command 'internal-domain-list' and then specify 'dns-suffix-search'.

config vpn ipsec phase1-interface
    edit <tunnel name>
        unset internal-domain-list
        set dns-suffix-search example1.com example2.com example3.com

    next
end

IKEv2 workarounds:

In FortiClient v7.4.3 and earlier, learning DNS suffix from FortiOS is not supported, but it is possible to manually set DNS suffixes on the VPN adapter.

To set the DNS suffix on the Windows FortiClient IPsec VPN adapter:

1. Open Start Menu and search for 'ncpa.cpl' or 'View network connections'.
   
   

2. Select the interface with the alias 'Fortinet Virtual Ethernet Adapter'.
   
   
3. Select 'Internet Protocol Version 4 (TCP/IPv4)' > Select 'Properties'.
   
   

4. Select 'Advanced'.
   
   
5. Select 'DNS' Tab -> In the 'DNS suffix for this connection' field, enter the desired internal domain -> Select 'OK'. 
   
   
6. Connect to VPN.

In FortiClient Windows v7.4.4 and later, it is possible to set dns_suffix_list manually for per IKEv2 connection in IPsec VPN XML, see IPsec VPN.

FortiClient macOS and FortiClient Linux do not yet support dns_suffix_list as of FortiClient v7.4.4.

Related documents:

Troubleshooting Tip: DNS resolution over IPsec/SSL VPN

IPsec DNS suffix