SSLVPN - Split Tunnel DNS Not Working on Wired Connection (Win 10)

[jeppen]

We recently upgraded our machines to Windows 10 and have come across a strange issue. Using FortiClient v. 5.4.0.0780 or 4.0.2300, when the user is plugged in via Ethernet cable, DNS does not function properly. It will only resolve Internet and local network names. Nothing to our network gets resolved, but can be pinged by IP no problem. If you connect via Wi-Fi, DNS works no problem. I have been switching everyone to 4.0.2300 since that seems to maintain the best connection - with 5.4 it will randomly drop the connection when downloading a large amount of data. This issue doesn't occur on Windows 7 with either client. I was wondering if it was something needing to be changed on the Fortissl adapter, but that cannot be edited in 10. Also when doing an IPCONFIG /ALL I see that the DNS servers do show up properly for "PPP adapter fortissl" but still does not work. Comparing the IPCONFIG /ALL of each on WiFi and Ethernet, the only difference I noticed was the "Tunnel adapter Teredo Tunneling Pseudo-Interface" was connected with Ethernet and on WiFI it showed as "media disconnected." I tried disabling that adapter but there was no difference in performance. I even tried the FortiClient app for Windows 10 but cannot seem to find a way to get it connected and we use a different port than default.

Any ideas would be greatly appreciated, I have exhausted Google of any possibilities for any issue remotely similar.

[burtmianus]

Hiya,

try disabling the poorly implemented Smart Name Resolution that Microsoft added to Win10, it helped us (save this as a .reg file and run on a machine - no reboot required):

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient] "DisableSmartNameResolution"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters] "DisableParallelAandAAAA"=dword:00000001

we have other DNS problems but this one did help some of them, you can also try:

administrator command prompt:

netsh interface ipv4 set interface "fortissl" metric=1

this can only be run when the tunnel is connected.

that's all i've got, like i said its fixed a few issue but we still have so many random problems that i'm getting lost trying to fix them all. one thing someone needs to fix is the issue with the underlying wan miniport adapter that causes the 98% drop back to login issue (rebooting as a workaround is not always practical). MS had a fix for win8 but nothing for win10 or 7.....