Question about the Group Policy DNS split tunneling options

[Chess_N]

Hi,

I'm configurering a Group Policy for RA VPN in Firepower FTD and  I'm trying to understand  the different options for DNS split tunneling in the group policys.

I thought that the option "Send DNS requests as per split tunnel policy", would only route dns request to internal domains, but it seams like AnyConnect uses the internal DNS servers for all request as long as those DNS servers are configured in the Group Policy . Is that correct? If so, I don't really seem the need for the other option "Always send DNS requests over tunnel". 

Can someone maybe give a brief explanation on what those different DNS Request Split Tunneling options does?

Thanks

Chess

Thanks

[inderdeeps]

@Chess_N : Follow the Doc

https://www.cisco.com/c/en/us/td/docs/security/firepower/config_examples/advanced-anyconnect-ftd-fmc/advanced-anyconnect-vpn-ftd-fmc.html 

[Chess_N]

Thanks, but I cannot find any explanation on the different DNS spilt tunneling options there.  

[balaji.bandi]

• Split DNS—You can configure the system to send some DNS requests through the secure connection while allowing the client to send other DNS requests to the DNS servers configured on the client. You can configure the following DNS behavior:
  • Send DNS Request as per split tunnel policy: With this option, DNS requests are handled the same way as the split tunnel options are defined. If you enable split tunneling, DNS requests are sent based on the destination addresses. If you do not enable split tunneling, all DNS requests go over the protected connection.
  • Always send DNS requests over tunnel: Select this option if you enable split tunneling, but you want all DNS requests sent through the protected connection to the DNS servers defined for the group.
  • Send only specified domains over tunnel: Select this option if you want your protected DNS servers to resolve addresses for certain domains only. Then, specify those domains, separating domain names with commas. For example, example.com, example1.com. Use this option if you want your internal DNS servers to resolve names for internal domains, while external DNS servers handle all other Internet traffic.

[Chess_N]

I've seen that explanation in the official Cisco documentation, but is the first option - Send DNS Request as per split tunnel policy - that confuses me. When testing this in my lab with a split tunneling Group Policy, all DNS request was sent to the internal DNS server configured in the group policy.

The only time it choose the DNS servers I got from my ISP, was when I shut down the internal DNS server.

nslookup didn't work at all, but I could still reach other domains, using my ISP assigned DNS servers. 

So my conclusion is that this option works as a fallback in case the internal DNS servers are not reachable.

/Chess

[balaji.bandi]

So my conclusion is that this option works as a fallback in case the internal DNS servers are not reachable.

There is no fallback here, the policy is strict as per splitting policy (i do not believe there is dynamic mechanism here,)

Other hand how will Local DNS information available on Public domains ? example business.local username.local.

Most organisation have 2-4 DNS Servers, so the dns lookup take place round robin, so if all down, service down thats all. (that will be wider problem in business, never seen that case, if that happends its P1 issue).

[Dill]

I have the same question.  Our Split DNS is blocking internet bound requests for some people and not for others.

If the Split Tunnel is defined by an Access List and the Access List contains only IP addresses, then how does the  Send DNS Request as per split tunnel policy option know which requests to send to the internal DNS servers?  The Send only specified domains over tunnel option makes perfect sense.

Thanks

[jason.emery]

You are correct the access-list contains only IP addresses and so the DNS requests will go over the tunnel if the IP address of the DNS server is in the split tunnel access list and not over the tunnel if the dns server ip address is not in the access list.