Cannot resolve internal DNS forward lookup zones when on AnyConnect VPN other than the primary internal domain

[davidbnbf]

We have a primary domain on internal DNS for our domain joined windows devices.  They connect to AnyConnect VPN and can resolve internal hosts on this primary internal domain.

We have secondary forward lookup zones for internal websites and for some reason VPN clients using Anyconnect cannot resolve these internal forward lookup zones only the primary forward lookup zone for the domain.

How do we allow VPN users on windows devices to resolve all of the internal DNS forward lookup zones correctly?

[Cristian Matei]

Hi,

   1. Do you have split-tunnelling or full-tunnelling for AnyConnect clients?

   2. Is the DNS server assigned to AnyConnect clients able to resolve those domains?

   3. Can these users resolve Internet resources?

   4. Post your group-policy config, and specify which domain can be resolved and which domain cannot be resolved.

Regards,

Cristian Matei.

[davidbnbf]

Split tunneling is ON.
Internal DNS servers are assigned to local IP pool on the VPN. We can resolve and ping these servers when on VPN.
Internet DNS resolution is working fine.
Only the default domain specified in the VPN config can be resolved when on VPN.
Additional forward lookup zones configured on our internal DNS servers do not resolve or resolve to external DNS/IPs.  We need them to resolve to internal DNS forward lookup zones when on VPN.

David

[Cristian Matei · Accepted solution]

Hi,

    Configure all your domains which need to be resolved via the DNS servers assigned to the AnyConnect client, in your split DNS policy:

group-policy XXX attributes

 split-tunnel-all-dns disable

 split-dns value domain1.com domain2.com domain3.com

Regards,

Cristian Matei. 

[davidbnbf]

This worked! Thank you.