VPN clients dns updates

[wngwngwng]

Hi all,

I currently have Anyconnect clients connecting to my ASA and obtaining IPs from the ASA IP address pools I created.  Is there a way to get the clients to automatically update the forward and reverse records with this IP?  I was looking at the Dynamic DNS management within the ASA, but wasn't sure if this work work.

Thanks in advance,

Bill

[Javier Portuguez]

Hi Bill,

I think this could be accomplished with a dedicated DHCP server.

Windows tries to perform this task automatically:

So once the VPN client gets an IP address from the DHCP server, the server registers the clients name.

Here is an example of to set up the ASA for this:

ASA/PIX: IPsec VPN Client Addressing Using DHCP Server with ASDM Configuration Example

HTH.

Portu.

Please rate any helpful posts.

[bravotom99]

I hate to respond to 2 year old posts but this is the same issue I am seeing.  Can the forward/reverse updates be updated if you use local pools instead of a DHCP server?  In my environment, it looks like the laptop eventually does a /registerdns which updates the forward lookup however the reverse never gets updated. Is there anything the ASA can do to pass this info onto the DNS server?

[don.click1]

I am going to bump this post as well.

We have a IP pool defined in the ASA. clients get the ip no problem. I just need to determine how we tell the ASA to send ddns updates to our Bluecat servers. I have yet to find a simple answer to this - most involve enabling DHCP server on the ASA, or moving the IP's to our Bluecat DHCP/DNS servers. Neither of these options are appealing to me.

[Eli Barb]

bump - same experience

[malkhati]

This is not supported as of now.

In order to have the DDNS and PTR records properly updated when a remote
client connects, we need to have the ASA send the FQDN of the remote client
to the DHCP server in charge of IP address assignment. Thus the ASA will
have to send Option 12 and Option 82 to make it work with the Anyconnect
clients. Although we can configure the ASA for DDNS updates, Option 82 is
currently not supported on ASA. Right now, the ASA will only send option 12
in the DHCP discover, populated with the hostname but we would need to have
the ASA send DHCP option 81 as well with the FQDN properly inserted. This
means that even if you have a DHCP server configured in your network, you
wouldn't be able to use DDNS with the Anyconnect clients due to this
limitation.

We have an Ench. Request https://bst.cloudapps.cisco.com/bugsearch/bug/CSCsv34395

[maciej.purcidis]

Thanks for update. Wanted to ask for further clarification as BugTracker says it's terminated but only lists old Anyconnect version. Is sending option 81 still not working?