DNS resolution over dialup L2TP

[jrosenberg]

Hi, all. I have a Fortigate 60D v5.2.4 with a working dialup SSL VPN. I'm trying to supplement or replace it with some sort of dialup IPSec VPN in order to move off of needing Forticlient on Windows/Mac/Linux and in order to get ChromeOS support at all. I was trying to choose between route-based or policy-based, but it seems that L2TP is the best (and perhaps only) way to go for ChromeOS and Windows native compatibility, so that means I need to use policy-based. However, I'm getting no DNS resolution over the tunnel. Clients connect successfully and can ping/SSH internal servers by IP address, but they cannot reach those servers over ping/SSH/HTTPS by domain name. I checked the client computer's resolv.conf, and it's getting the completely wrong nameserver; I'm not sure where that information is coming from. So, the question: Is there any way to fix DNS (or perhaps it's a DHCP problem) with a dialup L2TP VPN (or any dialup policy-based VPN)? I haven't found any solution with some searching, and I even found one forum post that implied this is not a supported feature, which seems silly as it would seem to make the entire L2TP feature useless.

Thanks in advance for any help you can provide! My configuration:

config vpn ipsec phase1
    edit "dialup_p1"
        set type dynamic
        set interface "wan1"
        set mode main
        set peertype dialup
        set proposal aes256-md5 3des-sha1 aes192-sha1
        set dhgrp 2
        set usrgrp "temp vpn group"
        set psksecret ENC *snip*
    next
end

config vpn ipsec phase2
    edit "dialup_p2"
        set phase1name "dialup_p1"
        set proposal aes256-md5 3des-sha1 aes192-sha1
        set pfs disable
        set encapsulation transport-mode
        set keylifeseconds 3600
    next
end

config vpn l2tp
    set eip 10.10.222.254
    set sip 10.10.222.1
    set status enable
    set usrgrp "temp vpn group"
end

config firewall policy
    edit 13
        set uuid *snip*
        set srcintf "wan1"
        set dstintf "vlan10"
        set srcaddr "L2TPclients"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 12
        set uuid *snip*
        set srcintf "vlan10"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action ipsec
        set schedule "always"
        set service "ALL"
        set inbound enable
        set outbound enable
        set vpntunnel "dialup_p1"
    next
end