IPsec DNS suffix

The DNS suffix enables DNS resolution of network resources using their hostnames, without requiring clients to specify their fully qualified domain names (FQDN). This feature is particularly useful in environments where users access internal resources over VPN connections. By appending a DNS suffix to unqualified domain names (such as hostnames), it enables end systems to generate FQDNs required for DNS resolution.

When a DNS suffix is configured for an IPsec tunnel, the configuration is pushed to FortiClient during VPN negotiations and is added to the DNS suffix list for the VPN adapter on the endpoint machine. This setting ensures accurate name resolution for unqualified domain names by appending the specified DNS suffix, which is essential for proper DNS resolution.

Currently, DNS suffix configuration is supported only for IKE version 1 and only one DNS suffix is configurable per IPsec tunnel.

If we assume that a DNS suffix named example.com is set for an IPsec tunnel, when a VPN client performs DNS query for server1 using only its hostname server1, the end system appends the DNS suffix it to make the FQDN server1.example.com. A DNS query is sent using this FQDN to the DNS servers configured for VPN clients.

Split Tunneling: If split tunneling is enabled on the IPsec tunnel, ensure that the address object used for split tunneling includes the IP address of the DNS server used by VPN clients. This ensures that DNS traffic flows correctly through the VPN adapter. Without this configuration, the DNS suffix is not applied, as DNS queries will bypass the VPN adapter.

Unqualified domains: The DNS suffix is only appended if VPN clients make DNS queries for unqualified domain names. The DNS suffix is not appended for DNS queries made for FQDNs (such as server1.example.com) or partially qualified domain names (such as server1.example).

The configuration of a DNS suffix on an IPsec tunnel requires enabling unity-support in the phase 1 configuration of the IPsec tunnel:

config vpn ipsec phase1-interface
    edit <name>
        set unity-support enable
        set domain <string>
    next
end

Command	Description
unity-support enable	Enables unity support to allow pushing DNS suffixes to VPN clients.
domain <string>	Specify the DNS suffix that is required to be pushed to VPN clients.