Hi,
I don't think I can give a really specific answer to this but to my understanding there is no real way to modify the DNS servers the DHCP server provides to the clients. There is a command for DHCP WAN interfaces that automatically applies the DNS servers the ASA gets with DHCP to the actual DHCP service that the ASA provides for the clients. But I am not sure if this will really work with 2 different WAN interfaces not to mention that you have the other WAN interface staticly configured and not using DHCP.
I am wondering if the solution would be to have an internal DNS server that would query information through both WAN links. I am not sure if this is possible since I really dont know much about the IT/Server side.
With regards to your VPN related problem I think it boils down to the fact that this is "to the box" traffic so the ASA passes the return traffic through the interface that holds the default route and therefore VPN connections through the secondary WAN link wont work.
Again as a solution I can only think of a solution that really would not be ideal. And that is if you could have a NAT capable device in front of the ASA on the secondary WAN link and PAT the VPN related traffic before it reaches the ASA (from the Internet) then the ASA would be able to forward the return traffic towards that PAT address.
The PAT address could either be from the link network between ASA and the device in front of it (on secondary WAN link) or if the PAT address was not from that network it could be routed on the ASA towards the secondary WAN link. This way you would not require a default route on the secondary WAN link also, just the static route for the single PAT address from where the ASA sees the VPN connections coming from.
- Jouni
