I've seen this same problem in every environment that I've working over the last 15 years or so, but I've never been able to find any good Internet Articles to help fix the issue. It would seem like MS and Cisco would come out with a simple way to make Dynamic DNS Updates work when using an ASA or FTD as the DHCP Source Pool. I certainly would NOT want to set my AnyConnect or S2S VPN Clients to pull DHCP from a separate Windows Server behind an ASA or FTD, cause if the Network ever has problems and that MS DHCP Server goes down or becomes inaccessible then you're not going to be able to VPN in at all (unless someone knows better?).
If anyone has an Answer of how to make AnyConnect VPN Clients update an MS DDNS Server without pulling IP Addresses from an MS DHCP Server PLEASE let us know! My current environment has over 80 Site-to-Site ASA to FTD VPN Tunnels, as well as hundreds over AnyConnect VPN Clients. All of the VPN S2S Locations get their DHCP from their local ASA, as we CANNOT have those locations unable to use their Local Networks if the VPN Connection goes down for any reason (this would cause HUGE Human Safety Issues for our Business). As well, putting a Windows Server out at those Locations to maintain is not an option either, as many of these Sites don't even have Power after hours, not to mention the Licensing and Administrative Overhead. As well, it would really help administratively to be able to ping -a any of these VPN Client IPs to easily track down issues. Or even just resolve their forward lookup Names to IPs for Administration purposes. Using Windows DHCP is just absolutely NOT an option for our type of Business, period!
Again, if anyone knows how to make Windows Clients dynamically update their Windows DNS Servers WITHOUT using Windows DHCP, PLEASE let us know!
