firepower 1140 anyconnect and FQDN

[kapydan88]

Hello for everybody.

I don't know how to formulate the question correctly...

We have anyconnect on firepower 1140. Users can connect without problems, all resources are available by ip, but when connecting/ping internal resources by name - not completely.

For example, if i try to ping server by ip - its ok.

If i try to ping by name without domain - not work.

If i try to ping by name with domain - its ok.

C:\Users\Nikita>ping 10.10.10.20

Pinging 10.10.10.20 with 32 bytes of data:
Reply from 10.10.10.20: bytes=32 time=30ms TTL=56
Reply from 10.10.10.20: bytes=32 time=32ms TTL=56

Ping statistics for 10.10.10.20:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 30ms, Maximum = 32ms, Average = 31ms

C:\Users\Nikita>ping srv01
Ping request could not find host srv01. Please check the name and try again.

C:\Users\Nikita>ping srv01.test.ru

Pinging 10.10.10.20 with 32 bytes of data:
Reply from 10.10.10.20: bytes=32 time=30ms TTL=56
Reply from 10.10.10.20: bytes=32 time=32ms TTL=56

Is it possible to fix this problem, so that users connected via anyconnect can ping and have access to resources, without specifying the full name with the domain.

[Rob Ingram · Accepted solution]

Hi,

Configure the "default-domain" command under the group-policy. E.g:-

group-policy GP-1 attributes
 default-domain value lab.local

This will allow you to resolve the hostname without appending the domain name.

HTH

[kapydan88]

How can i do this via FMC? 

Сan I add this part of the config as it is or "warm"? Will this affect users who are already connected?

[Rob Ingram]

Sorry, yes that's correct.

Yes you can make the change whilst users are connected, but the users will need to disconnect and reconnect for the setting to be applied to their session.