To resolve internal hostnames for remote endpoints, FortiSASE requires two key configurations. First, Split DNS rules are configured to specify which domain queries should be forwarded to internal DNS servers instead of public ones. Second, for the endpoint to communicate with the internal DNS server, the server's IP address must be reachable through the secure tunnel. This is achieved by configuring Split tunnelling destinations to include the subnet or IP address of the internal DNS server, ensuring traffic to it is routed through the FortiSASE tunnel to the private network.

A. SSL deep inspection: This is a security feature for inspecting encrypted traffic content; it does not influence DNS query routing or network path selection.

D. DNS filter: This security feature blocks or allows DNS queries based on domain categories or lists, but it does not direct queries to specific DNS servers.

1. FortiSASE 24.1 Administration Guide

Configuring split DNS

Page 101: "You can configure split DNS to resolve internal hostnames using your internal DNS servers instead of public DNS servers." This directly supports the need for Split DNS rules.

2. FortiSASE 24.1 Administration Guide

Configuring split DNS

Page 101

"Prerequisites": "You must have configured split tunneling to allow access to the internal DNS server." This explicitly states that split tunneling is a prerequisite

supporting the need to configure split tunneling destinations.

3. FortiSASE 24.1 Administration Guide

Configuring split tunneling

Page 99: "Split tunneling allows you to configure which subnets are accessible through the VPN tunnel. Traffic to other destinations goes directly to the Internet." This confirms the role of split tunneling in providing access to internal resources like DNS servers.