Technical Tip: Configuring split-dns on FortiGate for split-tunnel IPsec dial-up VPN

Description

This article describes how to configure split-dns for a split-tunnel IPsec dial-up vpn with FortiClient on FortiGate to resolve an internal domain.

Scope

FortiGate v7.2, v7.4, v7.6.

Solution

Topology:

client –internet-- FGT-kenobi –IPsec-- FGT-A -> server (Internal Domain, win.server.fgt resolves to 10.191.1.231).

• In this topology, there are 2 sets of interfaces that is taken into consideration, the dialup IPsec tunnel and the site-to-site IPsec tunnel that connects FGT-kenobi to FGT-A.

This dialup IPsec configuration is an ikev2 split-tunnel:

• Ensure ipv4-split-include, ipv4-dns-server1 and internal-domain-list are configured.

• Ipv4-split-include is the split-tunnel destination address. Ensure these destination addresses can be reached by the FortiGate. Check the routing.

• Ipv4-dns-server1 is the internal DNS server. Ensure this server can be reached by the FortiGate.

• Internal-domain-list is the name of the domains that are to be resolvable by the FortiClient users that connect to the VPN.

Note: If the command 'dns-suffix-search' is previously set under phase 1, the command 'internal-domain-list' will not be available. It is required to remove the command 'dns-suffix-search' and then specify 'internal-domain-list'.

config vpn ipsec phase1-interface
    edit <IKEV2 TUNNEL NAME>
        unset dns-suffix-search
        set internal-domain-list domain1.com
    end

1. Ensure the DNS Database feature is enabled. On the GUI, go to System -> Feature Visibility and Enable DNS Database under Additional Features.

2. In this configuration, the IP of the site-to-site IPsec tunnel interface is used as the internal DNS server IP because it connects to FGT-A, which then gives us access to our server. Our server’s domain name is win.server.fgt.

3. The domain wins.server.fgt, which resolves to 10.191.1.231. In Network -> DNS Servers, DNS Database, configure the DNS entry for the internal domain.

4. Enable DNS Service on both the dial-up VPN’s interface and on the site-to-site IPsec’s interface. Even if the site-to-site IPsec is just a regular interface, DNS Service must be configured on it as well as the following. If either of these interfaces is not configured with the DNS Service, resolution to the internal domain will not work:

5. Ensure firewall policies are configured with the Destination address having both resolved IP and DNS IP:

    

   

    

6. The Address Group used for the split-tunnel should look like this: 

Note: FQDNs are not supported in split-tunnel destinations. If FQDNs have been configured in the split-tunnel address group, it cannot be applied in the (set ipv4-split-include) config of the dialup IPsec.

After these steps, FortiGate and the VPN client should be able to ping the internal domain: