FortiGate 60B - DNS doesn' t work for connected clients for about 20 minutes - then it works??!

[#1]

So we have a FortiGate 60B unit that we use solely for VPN access for our employees. The unit sits on our LAN at address 192.168.2.69 Clients connect fine, and get an address something like 192.168.1.110 - ...220 We' ve configured the FortiGate with the address of our DNS server which is 192.168.2.7 and for secondary DNS, we put a public one, OpenDNS or something probably. The issue is that a client connects, can access anything by IP address but DNS doesn' t work at all. Public internet is fine. nslookup works fine too, and uses 192.168.2.7 as it should. Now the weird this is, after much testing, I' ve realised that if I wait about 20 minutes , and don' t touch anything, all of a sudden DNS starts working and I can ping anything on the network. Really confused and looking for ideas. thanks

[Maik]

just noticed that you already answered the last question.. nslookup works while ping does not. (ping uses a different resolver). so, please do a test if everything works when the DNS Client service is turned off (services.msc -> DNS client)

[#3]

It' s IPSec VPN All Windows versions seem to be affected Split Tunneling - not sure? I' ve just tried what you suggested, stopping the DNS Client service, and yes, if I stop it, everything resolves. If I restart it, and /flushdns, it' s back to not working again. So what does this mean? DNS Client is my problem?

[Maik]

In my case, it was somehow related to this: http://support.microsoft.com/kb/929853/en-us a fix from fortinet helped. (Should be included in 4.3 now as well). But it was with SSL VPN. however, XP clients were not affected (due the missing IPv6 stack). Just turning off the IPv6 stack on Win7 did not help. Disabled DNS client was a temporary workaround.

[#5]

Ok it' s become clear to me that our FortiGate, and possibly FortiClients have been configured wrong. The FortiGate is set up for DHCP relay, and I don' t think the server we specify is actually offering DHCP relay as a service. So I' m going to have to read the manual again and work out how to do this properly - this was all set up years ago before I started here. Thanks for everyone' s suggestions

[ede_pfau]

In this case you could just set up the FGT as DHCP server on that interface. Check the " IPSec" type, that' s about it.

[#7]

yep ede_pfau, that' s prettymuch what I' ve done. Actually it turns out that: (1) DHCP was configured for ' internal' , when it should have been ' wan2' because that' s where our users connect from. (2) DHCP was using one of our domain controllers as a relay, and I don' t think the server was set up for relay. (3) Our clients didn' t have the ' Acquire Virtual IP' checkbox checked. So really they had no hope of getting IPs or DNS server details upon connection. Thanks all. case closed