|
Configuration.
The following configuration can be seen in FortiGate
VIP configuration:
edit "Server"
set type access-proxy
set extip 192.168.10.2
set extintf "any"
set server-type https
set extport 26444
set ssl-certificate "Fortinet_Factory"
next
Access proxy:
edit "Server"
set vip "Server"
config api-gateway
edit 1
set url-map "/tcp"
set service tcp-forwarding
config realservers
edit 1
set address "ZTNA-SJ"
set domain "domain.com"
To identify the issue, run the following debugs in the FortiGate :
SJOFW01 # di de console timestamp enable
SJOFW01 # di wad debug enable category all
Debug messages will be on for 30 minutes.
SJOFW01 # di wad debug enable level verbose
Debug messages will be on for 30 minutes.
SJOFW01 # di de en
In the debugs, search for the wad_http_req_dns :
[V]2024-10-30 15:56:28.610184 [p:17042] wad_dns_parse_name_resp :323 domain.com: resp_type=0 notify=1 cdata=0 N/A
[I]2024-10-30 15:56:28.610187 [p:17042][s:3930806603][r:67109425] wad_vs_proxy_dns_request_done :3022 req(0x7f7ce3d35828) vs DNS resolved: N/A
[V]2024-10-30 15:56:28.610193 [p:17042][s:3930806603][r:67109425] wad_tcp_port_out_read_block :1005 tcp_port 0x7f7ce3e82048 fd=50 on=0 n_out_block=1~>0 in(/out)_shutdown=0/0 closed=0 state=2.
[V]2024-10-30 15:56:28.610195 [p:17042][s:3930806603][r:67109425] wad_tcp_port_transport_read_block :960 tcp_port 0x7f7ce3e82048 fd=50 on=0 n_out_block=1~>0 in(/out)_shutdown=0/0 closed=0 events=0x1.
[V]2024-10-30 15:56:28.610197 [p:17042][s:3930806603][r:67109425] wad_http_msg_strm_resume :1088 strm resumed, execute=wad_http_clt_read_req_line is_clt=1
[I]2024-10-30 15:56:28.610199 [p:17042][s:3930806603][r:67109425] wad_http_req_exec_on_vs_dns_ready :12458 req(0x7f7ce3d35828) vs DNS ready: dns_resolved(0), domain_matched(1), addr_matched(0)
[V]2024-10-30 15:56:28.610200 [p:17042][s:3930806603][r:67109425] wad_http_req_dns_fail :12420 req(0x7f7ce3d35828) vs DNS failed.
In the FortiGate DNS settings, public DNS servers are configured:
config system DNS
set primary 8.8.8.8
set secondary 8.8.4.4
end
Solution:
Change the FortiGate DNS server to the internal network DNS servers.
|
