default-dns not working in l2tp/ipsec

[joseluis.pedrosa]

Hi all

We've setup l2tp on asa, everything works except the default domain which is not set. This is required beacuse all links does not contain full dns:

this is cisco config:

ip local pool ClientVPNAddressPool 172.16.31.1-172.16.31.32 mask 255.255.255.224

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set TRANS-ESP-3DES-MD5 TRANS_ESP_3DES_SHA

crypto map PublicTESA_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map PublicTESA_map interface PublicTESA

group-policy DefaultRAGroup internal

group-policy DefaultRAGroup attributes

dns-server value X.X.X.X Y.Y.Y.Y

vpn-tunnel-protocol l2tp-ipsec

default-domain value AAA.BBBBBBB

address-pools value ClientVPNAddressPool

this is windows ipconfig /all:

Adaptador PPP Cisco ASA VPN: --> connection name

   Sufijo DNS específico para la conexión. . :                          --> connection-specific DNS suffix (BLANK)

   Descripción . . . . . . . . . . . . . . . : Cisco ASA VPN                --> description

   Dirección física. . . . . . . . . . . . . :                                         --> physicall address

   DHCP habilitado . . . . . . . . . . . . . : no                                 --> dhcp enabled

   Configuración automática habilitada . . . : sí                       --> automatic config enabled

   Dirección IPv4. . . . . . . . . . . . . . : 172.16.31.1(Preferido)   --> IP adddress

   Máscara de subred . . . . . . . . . . . . : 255.255.255.255      --> network  mask

   Puerta de enlace predeterminada . . . . . : 0.0.0.0              --> default GW

   Servidores DNS. . . . . . . . . . . . . . :  X.X.X.X                      --> dns servers

                                                            Y.Y.Y.Y       

   NetBIOS sobre TCP/IP. . . . . . . . . . . : habilitado    --> net bios over tcp enabled

Thanks!

[Marcin Latosiewicz · Accepted solution]

Hi Jose,

L2tp over IPsec will not be able to receive DNS suffix.

It's a limitation of PPP. More info:

http://cdetsweb-prd.cisco.com/apps/dumpcr?identifier=CSCse74376&parentprogram=QDDTS

Marcin

[joseluis.pedrosa]

Hi!

Thanks for answering.

so the stack is

ip --> Un encrypted

ipsec

ppp

l2tp

¿ethernet?

What kind of Client VPN could I do so i can send DNS sufix?

Thanks again!

[Marcin Latosiewicz]

Jose,

Both Cisco VPN client (pure IPsec/IKEv1) and Anyconnect (SSL and IPsec/IKEv2)  do support domain suffix.

For l2tpoIPsec stack>

IP -> (typically) ESP/UDP-4500 -> L2TP (in fact seen in "show crypto ipsec sa" to be UDP/1701)

And yes, rest should be pretty standard L2TP ;]

Marcin