I'm having trouble getting one of my Fortigate 200Es to be able to resolve hostnames.
If the system DNS servers are set to use the Fortinet servers (or any other external DNS servers), I'm unable to resolve any host names.
If I set the system DNS servers to our internal ones, I can resolve the host names but PING still fails.
Any ideas what I should check to get this resolved?
Thanks,
Wilson
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
You have two different issues. Using your own DNS solved the resolution issue. Next is the reachability. Do you have a policy from A-B with ICMP enabled? (or 'ANY')
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
Are you trying to ping the short name (e.g. server1) or the long name/FQDN (e.g. server1.domain.local)?
If you're only having trouble with short name resolution keep in mind that short names will only resolve if you have correct default DNS suffix configured.
On the FortiGate itself this is set under Network / DNS in the Local Domain Name field right below where you've set your internal DNS server IP addresses.
If you're finding that VPN clients can't resolve internal server names (short names) properly and network drives don't map correctly, etc. even with your internal DNS servers set correctly in the IPSec or SSL-VPN tunnel configuration, check that the DNS suffix is set correctly as follows:
[ul]Russ
NSE7
TecnetRuss wrote:Are you trying to ping the short name (e.g. server1) or the long name/FQDN (e.g. server1.domain.local)?
If you're only having trouble with short name resolution keep in mind that short names will only resolve if you have correct default DNS suffix configured.
On the FortiGate itself this is set under Network / DNS in the Local Domain Name field right below where you've set your internal DNS server IP addresses.
If you're finding that VPN clients can't resolve internal server names (short names) properly and network drives don't map correctly, etc. even with your internal DNS servers set correctly in the IPSec or SSL-VPN tunnel configuration, check that the DNS suffix is set correctly as follows:
[ul]If you're using IPSec Remote Access: config vpn ipsec phase1-interface show edit <VPN-dial-up-interface-name> set domain <internal-domain-suffix> (e.g. domain.local) end If you're using SSL-VPN Remote Access: config vpn ssl settings set dns-suffix <internal-domain-suffix> (e.g. domain.local) end[/ul] Russ
NSE7
These steps worked if in domain environment but not in a workgroup environment. Is there some other steps for vpn ipsec and ssl-vpn to do for workgroup computers as pinging their IP is ok but not the computer name.
Thanks.
The challenge in a workgroup environment is that peer devices typically use broadcasts and/or link-local multicast name resolution (LLMNR) to resolve hostnames to IPs for network resources. The FortiGate and remote VPN devices use DNS, not broadcasts or LLMNR.
Without a domain controller acting as a DNS server in your environment you can turn your FortiGate into a DNS Server by enabling the "DNS Database" feature. You can then manually create DNS records for all your internal devices directly on the FortiGate and then point your SSL-VPN clients to use the FortiGate as their DNS server.
Russ
NSE7
TecnetRuss wrote:The challenge in a workgroup environment is that peer devices typically use broadcasts and/or link-local multicast name resolution (LLMNR) to resolve hostnames to IPs for network resources. The FortiGate and remote VPN devices use DNS, not broadcasts or LLMNR.
Without a domain controller acting as a DNS server in your environment you can turn your FortiGate into a DNS Server by enabling the "DNS Database" feature. You can then manually create DNS records for all your internal devices directly on the FortiGate and then point your SSL-VPN clients to use the FortiGate as their DNS server.
Russ
NSE7
Thanks for the info. So the Fortigate DNS Server database does not update computer hostname records automatically and has to be done manually unlike the Windows DNS server. Will be ok for me as only about 2 3 Win10 workstations their hostname (acting as a workgroup database storage) need to be resolved over the remote office via ipsec vpn site to site.
Thanks! Had the issue with "short name" DNS name not working over SSL-VPN
Solved using #config vpn ssl settings -> #set dns-suffix <suffix>
if the FGT cannot reach the fortinet servers that might mean it has no route to the internet itself.
I'd check if you have a default route set up on the fgt in network->static routes.
That would also explain what you further described:
using you internal DNS works => FGT has an interface in that subnet - so there is a connected route to there so it can reach the internal dns and they do resolve. Still without default route on the FGT itself you cannot ping because that ICMP Echo would go to the internet.
It would then only work for internal hosts that your internal dns can resolve.
--
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
How can I change my FortiGate hostname as I am unable to change the default hostname. So please tell me something about it.
Hello,
Can you please elaborate what you are trying to achieve?
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1519 | |
1019 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.