Hot!Unable to resolve hostname

Author
wilson19
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/12/27 11:17:20
  • Status: offline
2020/03/25 04:22:08 (permalink)
0

Unable to resolve hostname

I'm having trouble getting one of my Fortigate 200Es to be able to resolve hostnames.
 
If the system DNS servers are set to use the Fortinet servers (or any other external DNS servers), I'm unable to resolve any host names.
 
If I set the system DNS servers to our internal ones, I can resolve the host names but PING still fails.
 
Any ideas what I should check to get this resolved?
 
Thanks,
Wilson
#1

6 Replies Related Threads

    rwpatterson
    Expert Member
    • Total Posts : 8531
    • Scores: 207
    • Reward points: 0
    • Joined: 2006/08/08 10:08:18
    • Location: Long Island, New York, USA
    • Status: offline
    Re: Unable to resolve hostname 2020/03/25 06:17:28 (permalink)
    0
    You have two different issues. Using your own DNS solved the resolution issue. Next is the reachability. Do you have a policy from A-B with ICMP enabled? (or 'ANY')

    -Bob - self proclaimed posting junkie!
    See my Fortigate related scripts at: http://fortigate.camerabob.com


    -5.0.14-b0323
    FWF81CM (1)
     
    -4.3.19-b0694
    FWF80CM (2)
    FWF81CM (2)
     
    #2
    TecnetRuss
    Silver Member
    • Total Posts : 54
    • Scores: 20
    • Reward points: 0
    • Joined: 2017/02/27 13:14:44
    • Status: offline
    Re: Unable to resolve hostname 2020/03/25 17:40:25 (permalink)
    0
    Are you trying to ping the short name (e.g. server1) or the long name/FQDN (e.g. server1.domain.local)?
     
    If you're only having trouble with short name resolution keep in mind that short names will only resolve if you have correct default DNS suffix configured.
     
    On the FortiGate itself this is set under Network / DNS in the Local Domain Name field right below where you've set your internal DNS server IP addresses.
     
    If you're finding that VPN clients can't resolve internal server names (short names) properly and network drives don't map correctly, etc. even with your internal DNS servers set correctly in the IPSec or SSL-VPN tunnel configuration, check that the DNS suffix is set correctly as follows:
    • If you're using IPSec Remote Access:

      config vpn ipsec phase1-interface
      show
      edit <VPN-dial-up-interface-name>
      set domain <internal-domain-suffix> (e.g. domain.local)
      end
    • If you're using SSL-VPN Remote Access:

      config vpn ssl settings
      set dns-suffix <internal-domain-suffix> (e.g. domain.local)
      end
    Russ
    NSE7
    #3
    KC Cheong
    New Member
    • Total Posts : 10
    • Scores: 0
    • Reward points: 0
    • Joined: 2008/12/27 02:47:29
    • Status: offline
    Re: Unable to resolve hostname 2021/05/13 21:07:36 (permalink)
    0
    TecnetRuss
    Are you trying to ping the short name (e.g. server1) or the long name/FQDN (e.g. server1.domain.local)?
     
    If you're only having trouble with short name resolution keep in mind that short names will only resolve if you have correct default DNS suffix configured.
     
    On the FortiGate itself this is set under Network / DNS in the Local Domain Name field right below where you've set your internal DNS server IP addresses.
     
    If you're finding that VPN clients can't resolve internal server names (short names) properly and network drives don't map correctly, etc. even with your internal DNS servers set correctly in the IPSec or SSL-VPN tunnel configuration, check that the DNS suffix is set correctly as follows:
    • If you're using IPSec Remote Access:

      config vpn ipsec phase1-interface
      show
      edit <VPN-dial-up-interface-name>
      set domain <internal-domain-suffix> (e.g. domain.local)
      end
    • If you're using SSL-VPN Remote Access:

      config vpn ssl settings
      set dns-suffix <internal-domain-suffix> (e.g. domain.local)
      end
    Russ
    NSE7




    These steps worked if in domain environment but not in a workgroup environment. Is there some other steps for vpn ipsec and ssl-vpn to do for workgroup computers as pinging their IP is ok but not the computer name.
    Thanks.
    #4
    TecnetRuss
    Silver Member
    • Total Posts : 54
    • Scores: 20
    • Reward points: 0
    • Joined: 2017/02/27 13:14:44
    • Status: offline
    Re: Unable to resolve hostname 2021/05/14 13:29:45 (permalink)
    0
    The challenge in a workgroup environment is that peer devices typically use broadcasts and/or link-local multicast name resolution (LLMNR) to resolve hostnames to IPs for network resources.  The FortiGate and remote VPN devices use DNS, not broadcasts or LLMNR.
     
    Without a domain controller acting as a DNS server in your environment you can turn your FortiGate into a DNS Server by enabling the "DNS Database" feature.  You can then manually create DNS records for all your internal devices directly on the FortiGate and then point your SSL-VPN clients to use the FortiGate as their DNS server.
     
    Russ
    NSE7
    #5
    sw2090
    Expert Member
    • Total Posts : 972
    • Scores: 82
    • Reward points: 0
    • Joined: 2017/06/14 01:27:25
    • Location: Regensburg
    • Status: offline
    Re: Unable to resolve hostname 2021/05/19 02:49:14 (permalink)
    0
    if the FGT cannot reach the fortinet servers that might mean it has no route to the internet itself.
    I'd check if you have a default route set up on the fgt in network->static routes.
    That would also explain what you further described:
     
    using you internal DNS works => FGT has an interface in that subnet - so there is a connected route to there so it can reach the internal dns and they do resolve.  Still without default route on the FGT itself you cannot ping because that ICMP Echo would go to the internet.
    It would then only work for internal hosts that your internal dns can resolve.

    -- 
    "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
    #6
    KC Cheong
    New Member
    • Total Posts : 10
    • Scores: 0
    • Reward points: 0
    • Joined: 2008/12/27 02:47:29
    • Status: offline
    Re: Unable to resolve hostname 2021/05/19 21:20:44 (permalink)
    0
    TecnetRuss
    The challenge in a workgroup environment is that peer devices typically use broadcasts and/or link-local multicast name resolution (LLMNR) to resolve hostnames to IPs for network resources.  The FortiGate and remote VPN devices use DNS, not broadcasts or LLMNR.
     
    Without a domain controller acting as a DNS server in your environment you can turn your FortiGate into a DNS Server by enabling the "DNS Database" feature.  You can then manually create DNS records for all your internal devices directly on the FortiGate and then point your SSL-VPN clients to use the FortiGate as their DNS server.
     
    Russ
    NSE7




    Thanks for the info. So the Fortigate DNS Server database does not update computer hostname records automatically and has to be done manually unlike the Windows DNS server. Will be ok for me as only about 2 3 Win10 workstations their hostname (acting as a workgroup database storage) need to be resolved over the remote office via ipsec vpn site to site.
    #7
    Jump to:
    © 2021 APG vNext Commercial Version 5.5