DNS over IPsec VPN

[NHC]

Hi

My setup:

FortiClient VPN -> FortiGate 40F <- Site-2-Site -> Zyxel -> DC

FortiClient subnet: 10.45.130.0/24 (DNS: 10.1.8.16)

FortiGate subnet: 10.45.134.0/24 (DNS: 10.1.8.16)

DC: 10.1.8.0/24

FortiGate firmware: 6.4.6

FortiClient: 7.0.8.0427

When I'm with my client on the subnet 10.45.134.0/24, I can ping and resolve all hostnames of my domain. But when I'm connected through my FortiClient VPN, I can still ping all IP's just fine, but I can't resolve and DNS names of my internal network. It's like it's not using the DNS on 10.1.8.16.

I have configured dns name for my FortiClient:

config vpn ipsec phase1-interface
(phase1-interface) edit <VPN TUNNEL NAME>
(VPN TUNNEL NAME) set domain abcd.local
(VPN TUNNEL NAME) end

I have tried to disable split-tunneling on the VPN connection, but still no luck.

I then tried to create a DNS Database on the Fortigate

Type: Secondary

View: Shadow

DNS Zone: abcd.local

Domain Name: abcd.local

IP or Primary: 10.1.8.16

And from the CLI I set the Source IP:

config system dns-database

edit "abcd.local"

set source-ip 10.45.134.1

end

But still I can't resolve abcd.local

Hope anyone here has an idea what to try next, or if I might have made a mistake while setting it up.

[NHC]

Testing from another Pc did work. So it might be an issue in the Sandbox environment.

Thanks for your help

[srajeswaran]

You have same DNS on 2 adapters, can you do a route print and make sure the DNS is reachable via the VPN adapter?
Please ignore if this is completely stupid idea.

[NHC]

Hi

That is because the VPN is connected. If I disconnect, I do only have it once :)

While it still was connected, I did the route print, which also looks good to me.

[srajeswaran]

When you tried to create the local DNS database on Fortigate, did you specify the sslvpn interface under "config system dns-server"?

Can you try that ?

https://community.fortinet.com/t5/FortiGate/Technical-Tip-DNS-queries-over-a-FortiGate-loopback-inte...

[NHC]

Yes, I did use that interface.

[NHC]

Here a picture of my Windows DNS server

nslookup to HYTDC01.xxx.abcd.local

Also ping to the same address

I'm about to install FortiClient on a new Pc to test.

[NHC]

Solution was found. When I tried to install the Client on a Pc, not a Sandbox or VM, then it does actually work. Feeling stupid for not trying that before.

Thanks all for suggestions.