Connection-specific DNS suffix for SSL-VPN

[veechee]

I would like the ability to assign the DNS search suffix for SSL-VPNs. This is the same thing that DHCP assigns using the ' Domain' option in Advanced. When users are on computers not joined to a Windows domain, this is how the computer finds resources to search, e.g., company.local or corp.contoso.com. The option for adding a suffix does exist in the PPP adapter in Windows, because I can assign it manually in the adapter settings after I connect to a SSL-VPN, but after I disconnect the setting is erased just like the IP and DNS server are. PPP adapter fortissl: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : fortissl Physical Address. . . . . . . . . : DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 10.100.199.200(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.255 Default Gateway . . . . . . . . . : 0.0.0.0 DNS Servers . . . . . . . . . . . : 10.100.100.10 NetBIOS over Tcpip. . . . . . . . : Enabled

[emnoc]

BTT for you , I' m curious about this also. But basically you need something like the DHCP option 119 ( search lists ).

[ejhardin]

The fortigate will support the standard DHCP option values from 1 to 255. (RFC 2132, DHCP Options) Another option would be to point the clients DNS address to your fortigate and enable DNS on the interface. Now create the dns domain and the " a" records pointing to your internal network.

[veechee]

As far as I know, DHCP is not involved at all in a SSL-VPN connection? ejhardin, I do point to local DNS server, either Windows DC if there is one, or else interface DNS (i.e., 10.100.100.1). However, unless the Windows client has the search suffix assigned, the lookups for ' server' instead of ' server.company.local' will still fail. The suffix tells it to search any names entered against that suffix first. Now, there is a way around this, which is to set Windows itself with a global Primary DNS suffix: (Win 7 Pro) System Properties -> Computer Name -> Change... -> More... I have this set for my main company network on my un-managed laptop, however, I connect to three different VPNs, so for the other two I am still SOL. I' m not sure if Win XP supports that same setting or not.

[ejhardin]

Veechee, Under the DHCP server settings on the Fortinet use option code 119 and enter the hex code for the suffix domain. You will need to use a website that converts text to hex.

[ddskier]

Unfortunately, there is no DHCP settings for SSLVPN. I don' t believe there is a screen or cli to make this setting change.

[veechee]

DHCP is not used for SSL VPN. For IPSec VPN' s and regular wired and wireless links, the suffix is easy to assign in the web interface without any special codes. Hence my request there be a way to apply the suffix to the PPP session created when the SSL-VPN session connects.