FortiClient SSL-VPN fails to restore DNS registration settings after disconnecting

[pcbron]

Since we migrated to Fortinet and SSL-VPN with FortiClient last year, we have had an increasing number of issues with the client leaving DNS registration disabled on wired and wireless interfaces after a user disconnects from VPN. 

The "no_dns_registration" option is set to 2 in the configuration, and it successfully disables registration for the local adapter(s) while connected and restores the setting after disconnecting the majority of the time.   However, we find at least one user weekly whose computer still has a VPN IP address in AD DNS even though they are in the office.   FortiClient version is 7.4.3 (VPN only).    The Advanced TCP/IP Settings window on their network adapter shows that DNS registration is disabled:

I thought it may be related to users closing their laptops while connected to VPN or otherwise not disconnecting cleanly, but thus far I have been unable to reproduce it on demand.  

Is anyone else experiencing this and do you have any suggestions for resolving it?   I'm working a script to clean up the settings periodically, but I am hoping for a less clunky solution.

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

[Anthony_E]

Hi,

If FortiClient SSL VPN fails to restore DNS registration settings after disconnecting, follow these steps to troubleshoot and resolve the issue:

1. Verify FortiClient Configuration: Ensure that the "Prefer SSL VPN DNS" option is configured correctly. If enabled, it should prepend the custom DNS server from SSL VPN to the physical interface.
2. Check DNS Cache Service Control: Confirm that FortiClient is set to disable Windows DNS cache when establishing an SSL VPN tunnel and that it restores the cache after disconnection.
3. Review Adapter Settings: After disconnecting from the VPN, manually check the DNS settings on the local adapter to ensure they are set to automatic. If not, manually set them to obtain DNS server addresses automatically.
4. Update FortiClient:  Ensure you are using the latest version of FortiClient, as updates may contain fixes for known issues.
5. Registry Key Verification: Check the registry key related to Smart Multi-Homed Name Resolution to ensure it is configured correctly: `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DisableSmartNameResolution`.
6. Reboot the System: Sometimes, a simple system reboot can resolve issues with network settings not being restored properly.