DNS over IPsec VPN

[NHC]

Hi

My setup:

FortiClient VPN -> FortiGate 40F <- Site-2-Site -> Zyxel -> DC

FortiClient subnet: 10.45.130.0/24 (DNS: 10.1.8.16)

FortiGate subnet: 10.45.134.0/24 (DNS: 10.1.8.16)

DC: 10.1.8.0/24

FortiGate firmware: 6.4.6

FortiClient: 7.0.8.0427

When I'm with my client on the subnet 10.45.134.0/24, I can ping and resolve all hostnames of my domain. But when I'm connected through my FortiClient VPN, I can still ping all IP's just fine, but I can't resolve and DNS names of my internal network. It's like it's not using the DNS on 10.1.8.16.

I have configured dns name for my FortiClient:

config vpn ipsec phase1-interface
(phase1-interface) edit <VPN TUNNEL NAME>
(VPN TUNNEL NAME) set domain abcd.local
(VPN TUNNEL NAME) end

I have tried to disable split-tunneling on the VPN connection, but still no luck.

I then tried to create a DNS Database on the Fortigate

Type: Secondary

View: Shadow

DNS Zone: abcd.local

Domain Name: abcd.local

IP or Primary: 10.1.8.16

And from the CLI I set the Source IP:

config system dns-database

edit "abcd.local"

set source-ip 10.45.134.1

end

But still I can't resolve abcd.local

Hope anyone here has an idea what to try next, or if I might have made a mistake while setting it up.

[funkylicious]

Hi,

Are you connecting to the FGT with FortiClient as a SSLVPN or a IPsec tunnel ?

[NHC]

Hi
I'm connecting with the FortiClient as a IPsec VPN

[funkylicious]

Please have a look at 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Setting-multiple-DNS-server-for-IPSec-dial...

and 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-DNS-resolution-over-IPsec-SSL-VPN/ta-p/191...

[NHC]

Hi

I do already use 10.1.8.16 as DNS for my Clients when they connect to the VPN, and as I wrote, I have also set the domain for the tunnel.

Here you see my ipSec setup for the Client VPN

[ebilcari]

Firstly check if the DNS server is shown in the end host interface "Fortinet SSL VPN Virtual Ethernet Adapter"

> ipconfig /all

if it is shown there try to ping it or do a nslookup to the server

> nslookup fortinet.com 10.1.8.16

If you don't get a response than check the policies if this traffic gets blocked

[NHC]

Hi
I checked, and you will find results attached.

ipconfig /all

ping 10.1.8.16

ping FQDN

nslookup

[ebilcari · Accepted solution]

So basically the VPN configurations looks correct since they push the DNS server. The DNS server is reached and can resolve names (policies ok) but it looks like Windows refuse to use this as valid DNS server.
If you run only > nslookup fortinet.com , which DNS server does respond to the query?

Can you try with a different client, is there any hypervisor active on this PC?

[NHC]

Hmm, it looks like it is using the correct one?

But even if I try to ping that DNS server on FQDN it fails

The Pc I'm testing from is running in Windows Sandbox. Will try to find another Pc I can install the client on.

[ebilcari]

this is strange :)
Are you using the whole FQDN for that A entry, or just the part prior to the suffix?

what happens when you nslookup to that name?