0

When one of our users connects to our ISA VPN server, 99% of the time, their computers are using the DNS servers bound to the physical interface to resolve host names. Every once in a while, they use the DNS servers bound to the VPN connection. This causes problems when connecting to our servers.

We're using the built-in VPN client in Windows XP SP3. From what I've read, as long as the option to use the VPN connection for the default gateway is checked, the VPNs DNS servers should take precedence over the physical Ethernet interface. Executing "nslookup" shows the proper default server, but also shows it trying to contact the DNS server on their physical interface. Is there any way for me to force the preference towards the proper DNS servers on our corporate network?

This seems to have become more of an issue due to Cox and some other ISPs serving incorrect DNS results when they should be returning Non-existent domain. Previously it seems that after an error it would roll over to our servers.

*Edited to include server and client config.

Improve this question
2
  • Knowing what vpn client and setup you're using might get you more specific answers.
    – GregD
    Jan 28, 2010 at 20:57
  • I just opened a web ticket with MS support for the problem. I'll be sure to post what I find just in case anyone else runs into this. Interestingly enough, I've tried connecting with a Windows 7 client and everything works perfectly. It's looking more like a client-side issue at this point.
    – bshacklett
    Feb 6, 2010 at 18:59

3 Answers 3

Reset to default
2

As it turns out, this is a defect in Windows XP. The network binding order is set incorrectly so that DNS requests are always made on physical interfaces. There is a good workaround for this problem at isaserver.org: How to work around an issue with VPN clients and split DNS

Improve this answer
1

I used the VB Script and it works. it´s an Windows Xp issue. Siehe also KB311218 With Windows Windows 7 --> no problem Nor

Improve this answer
0

Having no idea what your VPN setup is like because you don't mention it, with Cisco VPN via the ASA, you have the option to force DNS by turning on (or off) split tunneling. Split tunneling on means that anyone who connects to your vpn, also has local LAN access (internet, etc.). Split tunneling off means that ALL DNS requests go through your corporate tunnel and therefore hit your corporate DNS servers.

Improve this answer
1
  • Sorry, we're using ISA server with Microsofts built in RRAS services for the VPN server and the built-in remote access client in Windows XP SP3 to connect.
    – bshacklett
    Jan 29, 2010 at 1:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .