SA540 VPN Tunnel - No internet access or local DNS resolution

[CCMADM1N1_2]

Searching the forum, I have seen the "no internet when connected via full-tunnel to SA540 with Cisco VPN Client" (and even with SSL VPN Client) scenario/issue raised multiple times here in the past 6-12 months, but nobody has yet to post a "fixed" or "solved" acknowledgement

All the responses have been "just use split tunnel"  which is not a solution or even a workaround for someone who requires full tunnel specifically like I do

I have a simple Cisco VPN client capable IPSEC tunnel created using the VPN wizard on the SA540.

--I am setup for full-tunnel mode

--I can connect to my SA540 / remote site and authenticate just fine

--I can reach devices on my LAN (by IP address ONLY) while connected to the VPN

Problems:

--I have no name resolution capabilities on my LAN while connected to the VPN (I had name resolution when using a cheap consumer grade router that the SA540 replaced - no other/no dedicated DNS server onsite, only the router acting as local DNS server)

--I have no internet access while connected to the VPN

--I have tried every combination of VPN DHCP scope provided DNS servers - but no change in regards to internet access or Local LAN DNS resolution behavior when connected the tunnel

I am running the newest version of firmware code - 2.1.71 I believe from meory (but i verfied it is still the newest on Cisco.com)

Using the built-in UC560 EZ-VPN-Client at this and other locations, full-tunnel far-end/remote internet access works fine

So this issue seems isolated to the SA540 itself

For local DNS resolution, I am not sure if the expected behavior is that the SA540 can resolve local DNS machine names (Please advise)

But obviosuly full-tunnel internet access shoud work, which is the priority here for me. The local DNS resolution via the SA540 is a great to have.

--Can anyone at Cisco acknowledge this is a known bug / issue, and when I can expect a fix?

--Or is there anyone here that can confirm they have successfully created a Full-Tunnel with working internet using SSA540 + Cisco VPN client 9and if so, what version of code are you using?)

Thanks

Mike

[CCMADM1N1_2]

just to be clear when I say "local LAN" or "Local DNS" I am always referring to the LAN at the remote/far end (the site that the SA540 is located at)

I am connecting via Full-tunnel so I want ALL traffic to go into the tunnel - and I want both internet access and DNS-capable LAN access at the remote site where the SA540 is located - so i will have the same access/experience as if I was a user at the remote site physically

I dont want or need LAN or internet access where I am physically located with my VPN client - (if I did, I would have created a split tunnel!)

Thanks

[Tom Watts]

Hi CCMAADM1N1,

To fix the DNS issue, you need to delete the existing VPN policies then do the following;

Navigate to VPN -> IPSEC ->DYNAMIC IP RANGE.

Set the mode to full tunnel, specify the optional DNS fields and or WINS server

Then recreate the policies to use with the Cisco 5.x client.

-Tom

[CCMADM1N1_2]

Thanks -

Sent from Cisco Technical Support iPhone App

[CCMADM1N1_2]

Thanks - I suspected a reboot would fix the internet access (it did) since I made change sto the VPN DHCP SCOPE (changed DNS servers) after creating the policies (SA is a

nice device but requires reboot after most network related changes, not the most convenient but bearable if things work in the end)

But unfortunately even after delete/rebuild/reboot I cannot resolve DNS on the remote LAN while connected to full tunnel ipsec VPN

Does the SA540 have the capability/logic to handle the local DNS resolution for clients connected via VPN CLIENT from outside ? Doesn't seem so ..

The Same devices resolve DNS just fine when connected locally to the LAN so we know it works - just not working when same devices are connected via Cisco VPN Client from outside

Im thinking of rolling back 1 firmware release, and testing again - I could swear this worked/works on some older installs that I have not had the need or chance to upgrade since 2.1.51 i believe

Sent from Cisco Technical Support iPhone App

[Tom Watts]

Hi CCMA,

Yes the local resolution does work. Typically it should be configured as mentioned above. I'm not sure why it wouldn't.

You can also call to create a service request if the router has entitlement for support.

http://www.cisco.com/en/US/support/tsd_cisco_small_business_support_center_contacts.html

-Tom

[travisbugh]

I got a SA540 and I am having the same exact problem, cisco vpn 5 client, everything seems to work except the DNS resolution. Did you ever get this to work CCADM1N1?

[Dataprocess]

Me too.

Pietro