Troubleshooting Tip: DNS resolution delay after user is connected to IPsec VPN

[btan]

Description	This article describes how to resolve the DNS resolution delay issue after the user connects to the IPsec VPN.
Scope	FortiClient EMS v7.2.5 onwards and v7.4.0 onwards.
Solution	Issue symptoms: After connecting to the IPsec VPN, open the command prompt and perform a 'ping' to any internal hostname/FQDN. Observe about 5 5-second delay for the command to start pinging. Perform another 'ping' to the same hostname/FQDN, there will be no delay anymore. When performing an 'nslookup' on hostname/FQDN (even a new one), the result is instant.  Open a browser and go to any internal website, and it takes a significant delay for the website to start loading. Note: If the IPsec VPN is a full tunnel, these symptoms can also be observed on the external/public hostname and FQDN. Verifying the root cause: In the command prompt, run the command 'ipconfig /all'. Check the local network adapter section. Observe that the IPsec tunnel DNS servers are appended to the local network adapter. Solution: In FortiClient EMS, go to Endpoint Profile -> Remote Access -> Edit profile. Select XML view on the top right, configure <prefer_ipsecvpn_dns> to 0. Save the profile. Wait for the endpoint to sync the latest profile. Result: After the endpoint receives the configuration, perform testing again to verify the issue is gone. In the command prompt, after connecting to the IPsec VPN, run the command 'ipconfig /all'.  Observe that the IPsec tunnel DNS servers are no longer appended to the local network adapter. Perform 'ping' to any internal hostname/FQDN. There should be no delay anymore.