SSLVPN DNS Suffix

[FatalHalt]

Hi guys, I did some searching and saw this question a few times, but none have really been resolved.

I'm configuring a Fortigate to have an SSLVPN so that remote users can access resources back at HQ. The SSLVPN itself seems to be working fine, I can authenticate, connect and access resources behind the firewall. However, DNS does not seem to be working as expected.

I've set both the DNS-Server and the DNS Suffix in the SSLVPN Settings:

config vpn ssl settings
    set dns-server1 192.168.1.2
    set algorithm high
    set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
    set dns-suffix "their.domain.com"
end

And I've also set the domain name in the system dns settings:

config system dns
    set primary 208.91.112.53 (system default)
    set secondary 208.91.112.52 (system default)
    set domain "their.domain.com"
end

When I connect to the VPN, I'm able to ping resources by IP and FQDN, but not by short name. EX: Pinging 'server.their.domain.com' works and resolves the name, but just pinging 'server' doesn't.

When I look at my ipconfig /all on windows, this is what the FortiSSL Adapter looks like:

PPP adapter fortissl:
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : fortissl
   Physical Address. . . . . . . . . :
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.212.1.201(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.255
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : 192.168.1.2
   NetBIOS over Tcpip. . . . . . . . : Enabled

So it looks like the DNS Suffix isn't being sent or properly applied? My computer is on a completely separate domain than the domain of the network the firewall protects. When I use Wireshark to look at what DNS requests are being made, I see some requests going to 'server.my.domain.com' and 'server.myother.domain.com', but of course the DNS name does not exist on those domains. I never see a request going to 'server.their.domain.com.

This may be a windows issue, but I'm not sure what steps I need to take to fix it. Anyone have any idea what's happening?

[FatalHalt]

While I've been looking at this, I saw a handful of recommendations to try modifying HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\SearchList to include the domain 'their.domain.com'

This worked, and I was able to ping 'server', but as soon as my domains group policy re-applied, this settings was removed, and it was back to just my domain references. 

Is there a way to accomplish this in a different manner so that I don't have to worry about GPO?

[Sartuche24]

I see this as a major flaw in the FortiClient SSL VPN. You should be able to send multiple DNS Suffix's to a machine. Palo Alto and Cisco allow this but it FortiGate doesn't. Not all companies have a single DNS Suffix, example we have at least 4 and that's because of acquisitions. I guess I will need to look at seeing if running a script for the SSL VPN piece will correct the issue.

[Carl_Wallmark]

You can send multiple suffix names in ssl vpn, you have 255 characters, just use a space in between the domains: "Company.com ebay.com" etc....

[Sartuche24]

You know I tried a comma and that didn't work so I just assumed it wasn't going to work. Unfortunately the documentation lacks in regards to this. I made the change but will need to test when I get home as my work machine is a Windows machine and already has the suffixes added by GPO. Thanks for the quick response.

[Sartuche24]

Okay so I got home and doing a set dns-suffix "name.com name.com" works fine for my Windows PC but doesn't work on my MAC. Can anybody share details of BUG 0298065. According to TAC this has numerous fixes for SSLVPN on El Capitan?