Hi guys, I did some searching and saw this question a few times, but none have really been resolved.
I'm configuring a Fortigate to have an SSLVPN so that remote users can access resources back at HQ. The SSLVPN itself seems to be working fine, I can authenticate, connect and access resources behind the firewall. However, DNS does not seem to be working as expected.
I've set both the DNS-Server and the DNS Suffix in the SSLVPN Settings:
config vpn ssl settings
set dns-server1 192.168.1.2
set algorithm high
set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
set dns-suffix "their.domain.com"
end
And I've also set the domain name in the system dns settings:
config system dns
set primary 208.91.112.53 (system default)
set secondary 208.91.112.52 (system default)
set domain "their.domain.com"
end
When I connect to the VPN, I'm able to ping resources by IP and FQDN, but not by short name. EX: Pinging 'server.their.domain.com' works and resolves the name, but just pinging 'server' doesn't.
When I look at my ipconfig /all on windows, this is what the FortiSSL Adapter looks like:
PPP adapter fortissl:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : fortissl
Physical Address. . . . . . . . . :
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.212.1.201(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 192.168.1.2
NetBIOS over Tcpip. . . . . . . . : Enabled
So it looks like the DNS Suffix isn't being sent or properly applied? My computer is on a completely separate domain than the domain of the network the firewall protects. When I use Wireshark to look at what DNS requests are being made, I see some requests going to 'server.my.domain.com' and 'server.myother.domain.com', but of course the DNS name does not exist on those domains. I never see a request going to 'server.their.domain.com.
This may be a windows issue, but I'm not sure what steps I need to take to fix it. Anyone have any idea what's happening?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
While I've been looking at this, I saw a handful of recommendations to try modifying HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\SearchList to include the domain 'their.domain.com'
This worked, and I was able to ping 'server', but as soon as my domains group policy re-applied, this settings was removed, and it was back to just my domain references.
Is there a way to accomplish this in a different manner so that I don't have to worry about GPO?
I see this as a major flaw in the FortiClient SSL VPN. You should be able to send multiple DNS Suffix's to a machine. Palo Alto and Cisco allow this but it FortiGate doesn't. Not all companies have a single DNS Suffix, example we have at least 4 and that's because of acquisitions. I guess I will need to look at seeing if running a script for the SSL VPN piece will correct the issue.
FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C
You know I tried a comma and that didn't work so I just assumed it wasn't going to work. Unfortunately the documentation lacks in regards to this. I made the change but will need to test when I get home as my work machine is a Windows machine and already has the suffixes added by GPO. Thanks for the quick response.
Okay so I got home and doing a set dns-suffix "name.com name.com" works fine for my Windows PC but doesn't work on my MAC. Can anybody share details of BUG 0298065. According to TAC this has numerous fixes for SSLVPN on El Capitan?
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1466 | |
1006 | |
748 | |
443 | |
206 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.