Unable to resolve hostname

[wilson19]

I'm having trouble getting one of my Fortigate 200Es to be able to resolve hostnames.

If the system DNS servers are set to use the Fortinet servers (or any other external DNS servers), I'm unable to resolve any host names.

If I set the system DNS servers to our internal ones, I can resolve the host names but PING still fails.

Any ideas what I should check to get this resolved?

Thanks,

Wilson

[rwpatterson]

You have two different issues. Using your own DNS solved the resolution issue. Next is the reachability. Do you have a policy from A-B with ICMP enabled? (or 'ANY')

[TecnetRuss]

Are you trying to ping the short name (e.g. server1) or the long name/FQDN (e.g. server1.domain.local)?

If you're only having trouble with short name resolution keep in mind that short names will only resolve if you have correct default DNS suffix configured.

On the FortiGate itself this is set under Network / DNS in the Local Domain Name field right below where you've set your internal DNS server IP addresses.

If you're finding that VPN clients can't resolve internal server names (short names) properly and network drives don't map correctly, etc. even with your internal DNS servers set correctly in the IPSec or SSL-VPN tunnel configuration, check that the DNS suffix is set correctly as follows:

[ul]

If you're using IPSec Remote Access: config vpn ipsec phase1-interface show edit <VPN-dial-up-interface-name> set domain <internal-domain-suffix> (e.g. domain.local) end

If you're using SSL-VPN Remote Access: config vpn ssl settings set dns-suffix <internal-domain-suffix> (e.g. domain.local) end[/ul]

Russ

NSE7

[KC_Cheong]

TecnetRuss wrote:

Are you trying to ping the short name (e.g. server1) or the long name/FQDN (e.g. server1.domain.local)?

If you're only having trouble with short name resolution keep in mind that short names will only resolve if you have correct default DNS suffix configured.

On the FortiGate itself this is set under Network / DNS in the Local Domain Name field right below where you've set your internal DNS server IP addresses.

If you're finding that VPN clients can't resolve internal server names (short names) properly and network drives don't map correctly, etc. even with your internal DNS servers set correctly in the IPSec or SSL-VPN tunnel configuration, check that the DNS suffix is set correctly as follows:

[ul]

If you're using IPSec Remote Access: config vpn ipsec phase1-interface show edit <VPN-dial-up-interface-name> set domain <internal-domain-suffix> (e.g. domain.local) end

If you're using SSL-VPN Remote Access: config vpn ssl settings set dns-suffix <internal-domain-suffix> (e.g. domain.local) end[/ul]

Russ

NSE7

These steps worked if in domain environment but not in a workgroup environment. Is there some other steps for vpn ipsec and ssl-vpn to do for workgroup computers as pinging their IP is ok but not the computer name.

Thanks.

[TecnetRuss]

The challenge in a workgroup environment is that peer devices typically use broadcasts and/or link-local multicast name resolution (LLMNR) to resolve hostnames to IPs for network resources.  The FortiGate and remote VPN devices use DNS, not broadcasts or LLMNR.

Without a domain controller acting as a DNS server in your environment you can turn your FortiGate into a DNS Server by enabling the "DNS Database" feature.  You can then manually create DNS records for all your internal devices directly on the FortiGate and then point your SSL-VPN clients to use the FortiGate as their DNS server.

Russ

NSE7

[KC_Cheong]

TecnetRuss wrote:

The challenge in a workgroup environment is that peer devices typically use broadcasts and/or link-local multicast name resolution (LLMNR) to resolve hostnames to IPs for network resources.  The FortiGate and remote VPN devices use DNS, not broadcasts or LLMNR.

Without a domain controller acting as a DNS server in your environment you can turn your FortiGate into a DNS Server by enabling the "DNS Database" feature.  You can then manually create DNS records for all your internal devices directly on the FortiGate and then point your SSL-VPN clients to use the FortiGate as their DNS server.

Russ

NSE7

Thanks for the info. So the Fortigate DNS Server database does not update computer hostname records automatically and has to be done manually unlike the Windows DNS server. Will be ok for me as only about 2 3 Win10 workstations their hostname (acting as a workgroup database storage) need to be resolved over the remote office via ipsec vpn site to site.

[SvenBnS]

Thanks! Had the issue with "short name" DNS name not working over SSL-VPN

Solved using #config vpn ssl settings -> #set dns-suffix <suffix>

[sw2090]

if the FGT cannot reach the fortinet servers that might mean it has no route to the internet itself.

I'd check if you have a default route set up on the fgt in network->static routes.

That would also explain what you further described:

using you internal DNS works => FGT has an interface in that subnet - so there is a connected route to there so it can reach the internal dns and they do resolve.  Still without default route on the FGT itself you cannot ping because that ICMP Echo would go to the internet.

It would then only work for internal hosts that your internal dns can resolve.

[TradeLabelSoftware]

How can I change my FortiGate hostname as I am unable to change the default hostname. So please tell me something about it.

[abarushka]

Hello,

Can you please elaborate what you are trying to achieve?