DNS error with Mac OSX client of FortiClient

[kstreet]

When we connect to our SSL VPN with the Mac OSX client 5.2.3.370, we are not able to access external websites. If we navigate to http://www.google.com/, we receive an error that the "DNS lookup failed". However, we are able to access Google directly via its IP address (http://150.101.213.181/). This defect does not occur on the same computer, with the same Internet Connection, if we use the FortiClient 5.2.3.0633 on Windows (inside a virtual machine). Is there some sort of configuration option available in FortiClient or the FortiGate to fix this? Or is this a known defect in the Mac client?

[Christopher_McMullan]

In the SSLVPN settings for the portal the MAC client uses, are you employing split-tunnelling, or is all traffic forced through the VPN?

If split-tunnelling is enabled, you should still keep the DNS settings for your local Internet connection. If not, could you run a sniff on DNS queries from the client after connecting to the tunnel:

diag sniff pack any "host w.x.y.z and port 53" 4 //--replace 'w.x.y.z' with the IP assigned to your host upon connecting to the VPN

[kstreet]

Hi Chris,

Thanks for your reply.

Our vendor has informed me that split-tunneling is enabled and configured, hence why external internet access works on Windows.

Are you saying that there are separate SSLVPN settings for the Mac client and the Windows client? Where would we find the settings for the Mac?

Thanks, Keegan

[Christopher_McMullan]

There are no distinct settings for Mac OSX clients on the FortiGate side, as far as DNS servers go - you configure them for all clients using a specific external interface.

On the client side, you could backup the XML configuration file and search using Ctl+F for 'dns'. My Mac Fu isn't as strong as Windows, but you're looking for two things, broadly speaking: the DNS settings on the interface responsible for a tunnel mode connection after the tunnel is established (were the DNS server IPs pushed and applied properly), and a packet capture of the DNS requests themselves.