IKEv2 MacOS split DNS

[JvLeur]

Hi,

When a non Forticlient MacOS user connects to IKEv2 IPSec they have issues with split tunnel DNS.
DNS queries are only using the tunnel when using dig and implicitly querying a specific DNS server.
This causes issues with other traffic.

dig quanza-eun-ufg71.q @172.28.8.53 ~
;; QUESTION SECTION:
;quanza-eun-ufg71.q. IN A

;; ANSWER SECTION:
quanza-eun-ufg71.q. 86401 IN A 172.28.8.139

;; SERVER: 172.28.8.53#53(172.28.8.53)

With IPSec tunnel

ping quanza-eun-ufg71.q
ping: cannot resolve quanza-eun-ufg71.q: Unknown host

dig quanza-eun-ufg71.q
;; QUESTION SECTION:
;quanza-eun-ufg71.q. IN A

;; SERVER: 172.20.10.1#53(172.20.10.1)

I have checked the debug of the IPSec tunnel initiation and do not see an obvious difference.
Both Forticlient and Non-Forticlient connections acquire the DNS servers in the mode-cfg.

This issue does not occur with IKEv1

[JvLeur]

Unfortunately no, I haven't resolved it yet.

When I use Forticlient I can see the DNS servers in the Console log of MacOS and they get added to /etc/resolv.conf.
When I use IKEv1 with Native, I don't get the /etc/resolv.conf DNS servers but it does work.
When I use IKEv2 with Native, I don't get the /etc/resolv.conf DNS servers and it doesn't work.

I don't have a use case where I need to use a browser. When I use ping or ssh in the terminal, it uses the local dns server instead of the remote DNS server.

[kyle_koller]

Ohh I misread, I've only tested with the Forticlient so far, so our behavior isn't the same. Maybe I'll try the native vpn to see if that is opposite for me as well.