Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone have experience with configuring Cisco AnyConnect VPN? We have a problem with client DNS name resolution when connected over VPN.

To me, it looks as if the Cisco AnyConnect VPN client intercepts DNS queries from the clients.

  1. Can someone confirm that the AnyConnect VPN client in fact does this (intercepts DNS traffic)?
  2. Where is this configured on the VPN server?


Here's how the routing table changes when I connect to the VPN:

$ diff -u /tmp/route_normal /tmp/route_vpn 
--- /tmp/route_normal   2010-01-20 19:23:47.000000000 +0100
+++ /tmp/route_vpn      2010-01-20 19:24:46.000000000 +0100
@@ -1,6 +1,10 @@
 Kernel IP routing table
 Destination     Gateway         Genmask         Flags Metric Ref    Use Iface UGH   0      0        0 ath0     *        U     0      0        0 vmnet1        *        U     0      0        0 ath0
+     *        U     0      0        0 cscotun
+   UG    0      0        0 cscotun
0    *        U     0      0        0 vmnet8
+     UG    0      0        0 cscotun
 default         UG    0      0        0 ath0


The IT guy has done "something" on the VPN endpoint. Now I get "recursion not available" when doing nslookup. The DNS servers have recursion enabled. So it must be the Cisco VPN DNS interception messing this up.

ubuntu@domU-12-31-39-00-ED-14:~$ /opt/cisco/vpn/bin/vpn connect xxx.xxxxxx.xx
  >> Please enter your username and password
  >> notice: Establishing VPN...
  >> state: Connected
  >> notice: VPN session established to ...
ubuntu@domU-12-31-39-00-ED-14:~$ nslookup
;; Got recursion not available from ..., trying next server
;; Got recursion not available from ..., trying next server
;; Got recursion not available from ..., trying next server
;; Got recursion not available from ..., trying next server

** server can't find REFUSED

ubuntu@domU-12-31-39-00-ED-14:~$ ping
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=240 time=110 ms
64 bytes from icmp_seq=2 ttl=240 time=111 ms
64 bytes from icmp_seq=3 ttl=240 time=109 ms
--- ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2017ms
rtt min/avg/max/mdev = 109.953/110.379/111.075/0.496 ms
share|improve this question
What are you using for your VPN endpoint? ASA? Pix? – GregD Jan 20 '10 at 18:08
Is your client set up for split-tunneling? – GregD Jan 20 '10 at 18:09
I am on the end-user side of the table here, I am working with the IT department to test the VPN setup. I know the endpoint is ASA. As for split-tunneling, how do I check that? Would it show up in my client's routing table? – codeape Jan 20 '10 at 18:23
up vote 0 down vote accepted

As mentioned in a comment, figure out your split-tunneling (routing) first. The endpoint (Concentrator, ASA, PIX, etc.) admin usually has full control of how the client will handle this; some companies will only tunnel their network (so your client's DNS would go over the ISP) and some require tunneling all traffic over the link (so DNS would go over the link to corporate). It's a business/IT decision most of the time.

Peak at the routing table on the client and see what the gateways and such look like and where the traffic is being routed in their specific instance to provide the beginning point for your debugging. You might then try direct DNS queries from the client against a public resource (i.e. Google's new DNS thing) to see what the results are, while using TCPview (if your client is Windows) type software to watch the bits fly around.

share|improve this answer

Check what apparent source IP address is being used when your DNS requests hit the internal DNS server.

It's probable that the server has been configured to only provide recursive service for requests that arrive from known internal IP addresses, and to otherwise only offer authoritative service for certain domain names that are hosted on the same server.

If your DNS requests appear to be coming from an off-net IP address then they'll only get authoritative answers, and no recursive ones.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.