We have been using SSLVPN in tunnel mode with FortiClient for awhile with good success. Intranet and Internet web browsing was successful. Recently, we turned on split-tunnelling so all Internet browsing wouldn' t come through our corporate network. When we did this, we started having some difficulties with name resolution for internal systems.
Allow me to explain:
Consider the scenario: Laptop at home on DHCP (supplying ISPs DNS) on the wireless network adapter. Launch FortiClient and connects. Fortigate supplies DHCP address (with Internal DNS servers) for ' fortissl' network adapter. The system now has two sets of DNS servers configured. However this happens, it seems the process of connecting the FortiClient tunnel makes the fortissl DNS settings the preferred ones, so name resolution will happen on the Internal DNS server which is what we want. If I launch nslookup, I get the following:
Default Server: resolver1.opendns.com
Default Server: dc01.abcdefg.com
So far so good, I guess.
We are in a Split DNS environment, so if I attempt to resolve a server name, it will resolve whether the tunnel is connected or not, but with different addresses. Externally it resolves to our wildcard external address, internally, the host record is returned.
Pinging fs01.abcdefg.com [72.22.X.X] with 32 bytes of data:
Pinging fs01.abcdefg.com [172.16.0.133] with 32 bytes of data:
Again so far so good, I guess.
The problem is, in my testing over the past few days, it seems like that change is not immediate. If I attempt to ping an internal system immediately (within 2 to 4 seconds) after seeing the FortiClient report " Connected" on the tunnel, it will give me the same results as if it was disconnected every time. Then that DNS entry is cached and will continue to fail until some distant timeout is passed. If I wait and don' t do anything until about 8 or 10 seconds after the connection is established it will be successful pretty much every time. Also, if I issue an ipconfig /flushdns, after its connected, it will work after that.
It might sound like a minor problem, but as far as I' m concerned it should just work. I might be totally off base with my troubleshooting, but has anyone seen this before? I don' t understand why it only seems to have showed up after we turned on split tunnelling and why it seems to need some time after it says ' connected' for it to actually work.
Thanks in advance for any input.