Split DNS

[Magion]

I configured sslvpn with split-tunneling and split-dns. Split-tunneling works fine, but split-dns not. It looks like all dns requests are sent to the remote dns, instead of only the specified domains.

config split-dns
    edit 1
        set domains "domain.com,sub.domain.com"
        set dns-server1 192.168.100.10
        set dns-server2 192.168.100.20
    next
end

Resolving hosts on the remote network is fine, however local dns names are not working. Drive mappings on my client time out after a while (probably dns record ttl) and are inaccessible, rdp and web no longer are able to connect to local resources unless I use IP addresses.

My client is on a local network with it's own dns servers, and like to keep access to local resources.

All local resources are available though, so split-tunneling is ok.

Using dnslookup for local network entries does work, however that's because it connects to the local dns server using ip.

[eenchev]

Hi,

On my side I am still experiencing the issue. I have set in both the tunnel mode ssl web portal profile and in the ssl vpn settings, dns-suffix someclient.com and 2 dns servers.

When I connect with FC 6.4.0.1464 (latest as of now) to the client FG500E running 6.4.1 - in Windows 10 my ethernet adapter is prepended with the client's 2 DNSs set in the ssl config and seems that all DNS requests are going via the tunnel. Since the 2 DNS IPs are added manually at the top on my ethernet adapter even for my local domain I am sending requests via the tunnel.

[Magion]

The release notes of 6.4.0.1464 contain an entry regarding split-dns, so I guess support might have thought this would fix the issue.

Edit: I added an note to the support ticket with links to the online help and 2 KB articles explaining how split-dns should work. You might want to create a support ticket aswell. Maybe this will help?

[sw2090]

I ran into this too during configuring ipsec tunnels for homeoffice here. I found that split dns will only work this way: you can set dns server(s) and domain via gui (or FMG gui if you have and prefer). This is what you already have done. You still must set dns mode to manual and for unknown reasons Fortinet did not include this option in gui (on FMG it is in gui somewhere in the advanced settings of the ipsec phase). Also it is not shown in cli as long as it has the default value. Default value for dns mode is auto or something like that. With this the Tunnel will not do split dns. Once you set dns mode to manual (and maybe reconnect your vpn client afterwards) it shoud work. It did so here...

[Magion]

Thanks, however it looks like dns-mode is a ipsec only command. We're using sslvpn.

[Magion]

https://kb.fortinet.com/kb/documentLink.do?externalID=FD48421 describes exactly what I need... if only it would work

Unfortunately I'm unable to proceed with support since I don't have a EMS/FCT license. Apparently they also do not accept bug reports for free software... too bad.

[sw2090]

hm don't know. We don't use ssl vpn at all so can't say much about it.

[Magion]

Just had a call with Fortinet support. The support engineer was kind enough to show me a working split-dns configuration using an interim built of the FortiClient. So the issue is actually being fixed :)

My ticket is now closed (as I don't have a valid FCT/EMS license), but at least I know a fix is coming. Unfortunately he could not tell when the new version will be available. The fix is most likely to be included in 6.2 and 6.4 clients, but the internal ticket did not mention 6.0.

[UrbyTuesday]

so...have we come to the conclusion that despite advertising this functionality, at present Fortigate does not in fact offer functional Split-DNS over SSL VPN capability without some esoteric combination of firmware and/or Forticlient (paid or unpaid)?

I have a remoteapp in our datacenter my VPN users need to access.  The folks on-site at the local office are directed over IPSEC to the DC. No problem.  Custom entries on the local DNS server make that happen.

My work at home folks use SSL VPN to the home office to connect to shared drives.  They can be routed to the datacenter, but they get MUCH better performance connecting to the RD Gateway directly.  We are in a somewhat remote area with limited home office internet performance. 

So at this point with no functional SSLVPN SPLIT-DNS, am i forced to wait for a fix, or is there some combination of Forticlient (paid or unpaid) and firmware which will allow it?

The current solution is "Connect to the RDGateway first.  Then connect the Remoteapp."

This is wrong on SO many levels. Think about how ridiculous it is that one should need to RESEARCH firmware versions to find one where standard, advertised functions actually work.  "So and so works with B firmware but not C firmware. You need to upgrade/downgrade."  That is asinine.    

It's basic blocking and tackling.  Do this junk happen with other major firewall vendors?  I swear it's always SOMETHING with these Fortinet boxes.  Love-hate relationship if there ever was one. 

[Magion]

I can confirm that split DNS was fixed in FortiClient 6.2.8.