1

We have Windows XP SP2 clients running the Cisco VPN 3000 client (3030) on wireless connections. When off the VPN, the clients get their DNS servers from DHCP (they are definitely not statically configureD). In some cases, the clients continue trying to talk this DNS server even after they get on the VPN, even though the VPN concentrator is giving out different DNS Server addresses.

Has anyone seen this?

Thanks

1
  • Yep, this is a pain. +1
    – nray
    Aug 4, 2009 at 21:41

5 Answers 5

1

It is possible that your DNS server settings that your VPN concentrator is giving out are not covered in the split tunnel networks that GregD mentions. If your VPN DHCP scope gives out DNS servers and these are NOT covered by the split tunnel networks the client will try to reach the DNS servers over its default gateway, which will be the local router they are connected to.

I have to disagree with the statement that the ful VPN is more secure - you don't really want your web browsing traffic being routed across the corporate WAN over the VPN, particularly if the client is not managed by the company and you have no control over AV, patching etc - you could be transmitting all sorts of bad stuff onto your corporate network.

1
  • Thanks smallcheese. The reason organizations choose to route all traffic over the corporate network is because then any network/gateway security and/or compliance solutions will see the traffic and act accordingly. If you allow traffic over the machine's local interface (to the local LAN) you don't have the benefit of those protections.
    – Matthew
    Jun 28, 2009 at 2:00
1

I believe this has to do with the Connection order of the network adapters on your XP machines. Your wireless connection has a higher precedence than your VPN connection and is using the DNS servers configured there before it uses the DNS servers configured in your VPN connection. To check this:

1) open your Network Connections window

2) Go to the Advanced Menu, Advanced Settings...

3) The top part of this window lists your network connections in the order they are accessed. Put your VPN connection at the top of the list and they should start using the proper DNS servers while they are on the VPN.

1
  • There are additional conditions introduced by Vista that could affect the DNS server priority in VPN situations but for XP this should be solely dictated by the adapter priority. Aug 4, 2009 at 21:43
0

There is usually only one reason for this: You're using Split Tunneling as opposed to Full Tunneling. In the former, you're allowing them local lan/internet access while also allowing them access to the VPN, two interface cards will show up in ipconfig.

With full tunneling, all traffic must travel through the VPN tunnel, which, from a security standpoint, is the most desired setup.

2
  • Hi Greg - actually we don't allow access to any local lan resources while connected to the VPN.
    – Matthew
    Jun 28, 2009 at 1:57
  • @GregD Can you please elaborate on why it is preferable from a security standpoint to have all traffic travel through the vpn tunnel?
    – Emilio
    Nov 10, 2014 at 20:50
0

I havent seen that specifically, but have you tried the command 'ipconfig /flushdns'...if so, does it resolve the issue, even temporarily?

0

One workaround which may suit users who are mainly off the corporate network is to enable VPN login before Windows login, in the options of the Cisco VPN Client. This should help preserve homedrives and allow login scripts. Of course it's more annoying for users who mainly log on at the office.

Another suggestion I had heard is that a particular application may cache its name resolution attempts, even after you have flushed the DNS resolver cache, so that open window of Explorer might believe that serverx is not reacheable until you restart Explorer, howver I have not been able to confirm this.

I have experienced this problem, it is frustrating to trouble-shoot because users are by definition offsite when they experience it. Another factor which complicates a split tunnel configuration is that if your internal domain is company.com you way well have external public-facing DNS for www.company.com etc - when your user tries to resolve the internal fileserver.company.com they'll get an authoritative answer from the external DNS that "fileserver" doesn't exist.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .