We've been using Fortigate and FortiClient managed by EMS for many years now. The Fortigate is currently on 6.0.10 and the FortiClients vary from 6.0.5 to 6.0.10. We have several hundred VPN users and most work without issues.
We've had a couple of users now report they cannot access internal resources. When we check the client, we find they can reach the host by IP, but it appears Windows isn't using the internal DNS server to resolve the host name. If we open a command prompt and type NSLookup, it connects to the internal DNS server we have defined in the SSLVPN settings. We confirmed the DNS suffix is also configured in the Fortigate SSLVPN configuration.
The large majority of clients work, but it seems the list of users having issues resolving internal hosts by name is slowly growing. I'm not sure if a Windows update has suddenly caused this to start, but I am looking to the community for some suggestions?
Denny
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
We believe we tracked this issue down. We discovered the clients having issues were using IPV6 and learned about this feature in Windows call "Smart Multi-Homed Name Resolution". It sounds like Windows will forward a DNS query to both the IPV6 and IPV4 DNS servers and use the first response.
We added a regkey to disable the parallel queries and the issue cleared.
Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters
[ul]
Denny
We believe we tracked this issue down. We discovered the clients having issues were using IPV6 and learned about this feature in Windows call "Smart Multi-Homed Name Resolution". It sounds like Windows will forward a DNS query to both the IPV6 and IPV4 DNS servers and use the first response.
We added a regkey to disable the parallel queries and the issue cleared.
Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters
[ul]
Denny
I had the same problem. But with this solution you don't have to adjust regedit.
The way to fix this is using the cli, since you do not have that option in the webinterface.
Start the cli
[ul]Reconnect the vpn and you will see that you now have the correct ip address information.
Cheers
I had the same problem , here is how i solved it:
https://kb.fortinet.com/kb/documentLink.do?externalID=FD37484
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1692 | |
1088 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.