Intermittent DNS issue over client vpn

[sprocket10]

We are having intermittent dns issues with clients connecting in remotely via Cisco VPN on their laptops to our ASA.

They can successfully create a tunnel, I can remote to their machines, they can ping and access 95% of the servers on the network using IP or DNS. So everything seems to be working. The issue is if they try to access or ping a system on the network using DNS that also has an external DNS record. The laptop is resolving the DNS name to the external IP rather than the internal IP. The problem is this is only happening to some people and if the affected users try the exact same thing from a different internet connection, then it works with no issue.

I thought I had tracked this issue to a certain ISP, but it isn't the case and seems to be affecting more and more users. This wasn't an issue a few months ago.

[rizwanr74]

Hi there,

"The laptop is resolving the DNS name to the external IP rather than the internal IP. "

Do you have split-dns enabled on your group-policy?

If you have not, then natually remote-vpn client machince will forward dns-lookup to remote ISP, instead of forwarding to your internal dns server for the given internal or external domain-names.

group-policy my-grp-policy attributes
 split-dns value  abc.com xyz.com whatever.com mydomain.com yourdomain.com

thanks

[sprocket10]

In the group policy, under split tunneling, we have "Send All DNS Lookups Through Tunnel" already set to yes

[rizwanr74]

Well, if you haven't specified given domain names in the split-dns value, then the remote client will send those unspecified domain name lookup to remote ISP, therefore if you want xyz.com lookup come into the tunnel, then you must include it in the slipt-dns value.

[sprocket10]

We already have this set.

As mentioned in the first post, this is an intermittent issue only affecting some users. It can work in some remote locations but not others. I do think its only happening with certain ISPs and has only been happening recently.

Has been working great for years.

[rizwanr74]

Do you have those public ip address permitted in the split-tunnel ACL as well?

[sprocket10]

The issue turned out to be that the VPN network adaptor in windows needed moving to a higher priority. Not sure why it was working for all these users and then stopped working with certain ISPs only