FortiGate 60B - DNS doesn' t work for connected clients for about 20 minutes - then it works??!

[#1]

So we have a FortiGate 60B unit that we use solely for VPN access for our employees. The unit sits on our LAN at address 192.168.2.69 Clients connect fine, and get an address something like 192.168.1.110 - ...220 We' ve configured the FortiGate with the address of our DNS server which is 192.168.2.7 and for secondary DNS, we put a public one, OpenDNS or something probably. The issue is that a client connects, can access anything by IP address but DNS doesn' t work at all. Public internet is fine. nslookup works fine too, and uses 192.168.2.7 as it should. Now the weird this is, after much testing, I' ve realised that if I wait about 20 minutes , and don' t touch anything, all of a sudden DNS starts working and I can ping anything on the network. Really confused and looking for ideas. thanks

[emnoc]

How are you testing with nslookup? And have you set the dns server with nslookup from the client and from a local machine using debug? i.e ( nslookup from wins or linux ) nslookup server x.x.x.x set d2 " type a name of a site " Your problem might be DNS-server related and have nothing to do with the clients btw. Trying using 8.8.8.8 and 8.8.4.4 and see what happens.

[#3]

I' m just testing nslookup like this... C:\> PING SCSTORAGE1 Ping request could not find host scstorage1. C:\> NSLOOKUP SCSTORAGE1 Server: dell_server.purplemonkey.local Address: 192.168.2.7 Name: scstorage1.PurpleMonkey.local Address: 192.168.2.17 C:\> PING SCSTORAGE1 Ping request could not find host scstorage1. 8.8.4.4 and 8.8.8.8 both ping fine - there is no issue resolving public addresses, it' s the addresses on our internal company network that aren' t resolving.

[#4]

2 more things I' ve noticed... 1. Over time, after connecting, it seems that names slowly become resolvable, ie... after 10 minutes, suddenly it can ping dell_server, then 5 minutes later dell_server2 works, then other names start to work, and after about 90 minutes, I can ping everything. Is it possible that these machines are broadcasting their addresses, and the client just listens and keeps note of the addresses?? 2. I ran microsoft network monitor and looked for name resolution activity, whenever I try to ping from the VPN client, it doesn' t use DNS at all, it tries to resolve the name using netBIOS only, and fails. This seems like an important thing. Is there any way I can force it to ping using DNS instead of Netbios? even just for testing purposes?

[emnoc]

When you ping the short-name and have problems, how about the FQDN or in this case you dot local fullname " host" .purplemonkey.local ? And what does your ipconfig /all shows is your valid DNS-server entries? Sense you mention this;

We' ve configured the FortiGate with the address of our DNS server which is 192.168.2.7 and for secondary DNS, we put a public one, OpenDNS or something probably.

Maybe your hitting the public-dns server and it surely is not going to find " host" .purplemonkey.local. Other things to thank about, if the local resolution is the problem ( purplemonkey) what happens when you ping an external resouces www.microsoft.com or www.hp.com etc...? Does it resolve ?

[#6]

short name vs FQDN doesn' t seem to make any difference. they either both don' t work, or they both work. and to answer your question about ipconfig /all details, this is where it gets strange. I connect to VPN, and check IPCONFIG /ALL it shows the 2 DNS servers as specified in our FortiGate config, so it sounds like it is definitely getting the information. So I ping, and it fails. Then if I go into network connections wireless adapter settings, TCPIP v4, properties, and then manually enter the DNS severs *exactly* the same as is already showing in IPCONFIG /ALL, save that, and ping again. ping works. i' m so confused!! FortiNet wants to charge me $470 for another year of tech support and I feel like I' m so close to working this out... And regarding public internet resolution, no problems there at all. As I said, when I used the network monitor to see what was happening, the workstation seems to be hitting the right address for name resolution but it' s not using DNS, it' s using netbios and some other things.

[#7]

update: if I edit my FortiClient connection settings, and check the box for Acquire Virtual IP Address, then edit the settings for that, and manually enter IP address, DNS, mask etc, then everything seems to work fine. So it seems like unless I set these manually, clients are not receiving DNS server information when connecting. ??

[emnoc]

As I said, when I used the network monitor to see what was happening, the workstation seems to be hitting the right address for name resolution but it' s not using DNS, it' s using netbios and some other things.

have you considered disabling netbios for troubleshooting purpose? tcp ipv4 > properties> advance > netbios/tcp or whatever it is for windows adapter setting. If the problem is with local lookups, than I would start in that area and ensure that the client is not using netbios name resolution. But to me, it sounds like a local dns-server issue.

[#9]

seeing as the problem can be ' fixed' by changing tcp/ip settings on the client then I don' t see how you can assume the DNS server has a problem? So I disabled netbios and that does seem to make things better. but I don' t want to have to do that on every computer in our company. I don' t understand why the FortiGate isn' t setting the clients' DNS servers when they connect? Maybe we' ve missed something in our FortiGate config

[Maik]

I' m requesting some background infos: are we talking about SSL VPN or IPSec VPN? Are Windows 7 and Vista clients affected, while XP works? Is Split Tunneling enabled? Is the problem gone when you disable/turn off the DNS Client service? Does the name resolve with " nslookup" while " ping" to the same name fails?