SSL VPN split DNS

SSL VPN clients in tunnel mode can enable the following settings to split DNS traffic:

• Resolve DNS requests for a specific domain, or suffix, using specific DNS servers.
• Resolve all other DNS requests using a DNS server configured in the SSL VPN settings. This DNS server can be the same as the client system DNS server, or another DNS server.

Administrators typically configure SSL VPN clients to use DNS servers that are behind the FortiGate on the internal network. This will require DNS traffic to traverse the SSL VPN tunnel.

Configuring SSL VPN DNS servers to use DNS suffixes

The dns-suffix setting under config vpn ssl settings is used to specify domains for SSL VPN DNS servers in the tunnel mode configuration. This setting can only be configured in the CLI.

The DNS servers and suffixes configured under config vpn ssl settings have a global scope, and apply only to SSL VPN portals that do not have their own DNS server configuration.

To configure DNS servers for all SSL VPN portals:

config vpn ssl settings
    set dns-suffix domain1.com
    set dns-server1 10.10.10.10
    set dns-server2 10.10.10.11
end

SSL VPN portals configured with their own DNS servers and suffixes under config vpn ssl web portal override the settings configured under config vpn ssl settings.

To configure DNS servers for a specific SSL VPN portal in split tunnel mode:

config vpn ssl web portal
    edit "full-access"
        set dns-suffix domain2.com
        set dns-server1 10.10.10.12
        set dns-server2 10.10.10.13
        set split-tunneling enable
    next
end

Only DNS requests that match DNS suffixes use the DNS servers configured in the VPN. Due to iOS limitations, the DNS suffixes are not used for searching as in Windows. Using short (non-FQDN) names may not be possible.

Configuring SSL VPN DNS servers for tunnel mode using DNS split tunneling

The DNS split tunneling setting can be used to configure domains that apply to a specific SSL VPN portal by specifying primary and secondary DNS servers to be used to resolve specific suffixes. This setting can be configured in the GUI and CLI. In the following example, DNS split tunneling is configured on the default tunnel-access portal with two DNS entries.

To configure DNS split tunneling in the GUI:

1. Go to VPN > SSL-VPN Portals and double-click tunnel-access to edit the portal.

2. In the Tunnel Mode Client Options section, enable DNS Split Tunneling.

3. In the Split DNS table, click Create New. The New DNS Entry pane opens.

4. Configure the first DNS entry:

   1. For Domains, enter domain1.com.

   2. Set the Primary DNS Server to 10.10.10.10.

   3. Set the Secondary DNS Server to 10.10.10.11.

      

   4. Click OK.

5. Configure the second DNS entry:

   1. Click Create New.

   2. For Domains, enter domain2.com.

   3. Set the Primary DNS Server to 10.10.10.12.

   4. Set the Secondary DNS Server to 10.10.10.13.

   5. Click OK.

      

6. Click OK to save the portal settings.

To configure DNS split tunneling in the CLI:

config vpn ssl web portal
    edit "tunnel-access"
        set dns-suffix "domain0.com"
        set dns-server1 10.10.10.8
        set dns-server2 10.10.10.9
        set split-tunneling enable
        config split-dns
            edit 1
                set domains "domain1.com"
                set dns-server1 10.10.10.10
                set dns-server2 10.10.10.11
            next
            edit 2
                set domains "domain2.com"
                set dns-server1 10.10.10.12
                set dns-server2 10.10.10.13
            next
        end
    next
end