Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
kylehouk
New Contributor II

Set Fortigate as DNS server for SSL VPN Users

In our internal LAN we have the DNS server set to be the same as the Interface IP of that subnet. This DNS server is set in recursive mode and exists only to translate some domain names to IP address for internal uses.

 

I would like to have this same functionality over the SSL VPN for some of our remote users but am unsure how to go about setting it up. 

1 Solution
hbac

@kylehouk,

 

10.10.20.0/24 is for SSL-VPN subnet? You can specify the IP address of the ssl.root interface as DNS server. To configure ssl.root IP address: For example

 

config system interface 

edit ssl.root 

set ip 10.10.20.254/24

end 

 

After that, you can specify 10.10.20.254 as the DNS server. You also have to enable DNS service on ssl.root interface as mentioned here.

 

Regards, 

View solution in original post

6 REPLIES 6
kcheng
Staff
Staff

Hi @kylehouk 

 

You can configure SSLVPN interface to act as the DNS server and configure the same settings. Please refer to the document below:

https://community.fortinet.com/t5/FortiGate/Technica-Tip-How-to-allow-SSL-VPN-users-to-use-FortiGate...

Cheers,
Kayzie Cheng

If you have found a solution, please like and accept it to make it easily accessible for others.
kylehouk
New Contributor II

Thank you for the response, if I am using custom IP address ranges for the VPN does that impact this setting?

Fortigate_VPN.png

hbac

Hi @kylehouk

 

No, using custom range doesn't impact the DNS setting. You need to specify the DNS server IP address. 

 

Regards, 

kylehouk
New Contributor II

Hello @hbac 

 

In this case the subnet for one of the groups is 10.10.20.0/24 how would I go about setting a specific IP to act as the DNS server for the SSL VPN?

hbac

@kylehouk,

 

10.10.20.0/24 is for SSL-VPN subnet? You can specify the IP address of the ssl.root interface as DNS server. To configure ssl.root IP address: For example

 

config system interface 

edit ssl.root 

set ip 10.10.20.254/24

end 

 

After that, you can specify 10.10.20.254 as the DNS server. You also have to enable DNS service on ssl.root interface as mentioned here.

 

Regards, 

dbc-pri-med

HBAC,

Does the ssl.root IP need to be on the same subnet as the assigned ip addresses of the ssl clients? For example:

I have 4 ssl portals and each one is assigned a different subnet. right now they all use internal DNS servers that are on yet another subnet. 

Can it be as simple as assigning an IP to the ssl,root interface and then create static routes? Or could it be simpler?

are you receiving?
are you receiving?
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors