FortiClient 5.0.4 Mac OSX and DNS Suffix

[Patrick3]

Hello, It appears that the FortiClient 5.0.4 for Mac OSX does not properly pull down and apply the DNS search suffix settings configured on the Fortigate 100D firewall. Our windows clients are pulling the dns search settings fine but not the macs. I called tech support but the Fortinet rep said it was an issue with Mac OSX. I don' t think it is an issue with OSX as it was working with one of the other 5.0.x firmware versions on the firewall. Anyone else have any feedback on this problem? Kind regards,

[kolawale_FTNT]

Please explain how FortiClient is related to the DNS settings. Are you connecting to the FortiGate using VPN? If yes, please provide both the FortiOS and the FortiClient configuration files. If not connecting by VPN, explain how it was determined that the issue you posted is caused by FortiClient. If you shutdown FortiClient on the Mac OS X client, would the DNS settings correctly received?

[Patrick3]

Yes, this is specifically regarding users connecting via the SSL VPN client / portal. The DNS servers and domain suffix search settings are pushed to the client in windows but in osx the dns search suffix never gets pushed. I' ll try and post the configs later but keep in mind that the config works fine for windows and that Fortinet support people said the config on the firewall is ok.

[emnoc]

I will check on my unit, but don' t recall anything being pushed either to the MACOSX. I will post whatever I find later.

[emnoc]

MACOSX lion, no go either. # # This file is automatically generated. # nameserver 8.8.8.8 nameserver 8.8.4.4 # # Mac OS X Notice # # This file is not used by the host name and address resolution # or the DNS query routing mechanisms used by most processes on # this Mac OS X system. # # This file is automatically generated. # I even change stuff around and re-tried nameserver 8.8.7.7 nameserver 8.8.4.4 cat /etc/resolv.conf # # Mac OS X Notice # # This file is not used by the host name and address resolution # or the DNS query routing mechanisms used by most processes on # this Mac OS X system. # # This file is automatically generated. # domain ##### nameserver ####### nameserver ####### nameserver ####### And the config used; config vpn ssl settings set dns-server1 8.8.8.8 set dns-server2 8.8.4.4 set tunnel-ip-pools " SSLVPN_TUNNEL_ADDR1" set tunnel-ipv6-pools " SSLVPNpool1" set dns-suffix " example.com" set ipv6-dns-server1 2001:4860:4860::8888 set ipv6-dns-server2 2001:4860:4860::8844 end forticlient used;

[kolawale_FTNT]

emnoc, When using:

    set dns-suffix " example.com"  

in your FortiOS configuration, did you find that, after FortiClient has established an SSL VPN connection, you were able to ping a name in that domain? For instance,

    ping mail

gets resolved to mail.example.com? Is " example.com" included in the output of the command " scutil --dns" on your Mac OS X?