Not able to ping IPsec dialup users from internal network via FQDN?

[JoeyC]

Hello there,

Trying to move away from SSL and one of the last issues we're having in the setup is we are not able to ping users on the IPsec VPN via their FQDN. IP works fine but this makes me think the IPsec setup isn't communicating with our DNS server correctly.

Any ideas what could be causing this or anything I can check? Our DNS server works just fine with our SSL VPN and is able to resolve FQDN but for some reason our IPsec VPN isn't. 

I have both our DNS server IP and domain listed on our IPsec settings. 

[funkylicious]

hi,

upon connecting to the IPsec server, can you confirm that the computer gets assigned the dns / domain-name ?

also, is it a IKEv1 ipsec configured ?

you can do a debug flow or sniffer on the FGT and confirm that traffic is going through to the DNS server and it responds back.

[JoeyC]

Thanks for the response and ideas.

Yes, it gets the the correct DNS server. We also are using IKEv2 so that we can use SAML. 

I did use sniffer on the firewall and it does show communication between our DNS server and the firewall. That is the confusing part - everything is working except FQDN but only in one direction. Users on the IPsec VPN can ping internal devices via FQDN.

[funkylicious]

oh, i see. you cannot ping from internal to ipsec users.

does the dns get updated with their ipsec assigned ip address ?

[JoeyC]

No, it doesn't. Sorry I should've made that more clear in my initial post. That is my issue, I can see the SSL VPN IPs in there but not the IPsec IPs. 

[funkylicious]

i would check in 2 place while doing this command on the PC, ipconfig /registerdns

1. on the firewall to see what it tries to do, to communicate with what server and on what ports - if the traffic is permitted or not

2. on the dns server logs to see if any updates are being received if traffic is passing

L.E. i suspect that your pc connected to the ipsec vpn doesnt get a dns suffix, like it does when connected to sslvpn since this feature is not supported in ikev2, only ikev1 so i would try to set it manually to the virtual adapter and see if it works - https://docs.fortinet.com/document/fortigate/7.2.11/administration-guide/707911/ipsec-dns-suffix

[JoeyC]

Thanks for this info. I don't see anything in the DNS server logs involving this computer and not sure what I should be looking for on the Firewall. I see activity between the pc and the dns server but I was before as well. 

Edit: Tried the command in the link you sent me as well and unfortunately it doesn't seem to work. Getting 

command parse error before 'unity-support'
Command fail. Return code -61

[funkylicious]

the command wont work since it's only for IKEv1.

in your case you have IKEv2 so it doesnt apply.

[JoeyC]

Oh, I thought that was setting it manually. How do I set it manually to the virtual adapter? 

edit: I think I realized you mean in Windows - unfortunately this doesn't solve it as I've already tried.