Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We use a Cisco ASA 5505 as the firewall and IPSec VPN endpoint on our network.

We use split-tunneling to reduce the load on our internet link. In other words, when someone is connected to the VPN their DNS queries go through our internal DNS server, and all traffic for hosts that resolve to 10.0.0.0/8 is sent through the tunnel. Other traffic is sent through their local internet gateway. This has worked well for IPv4 traffic.

I've now rolled out IPv6 connectivity (a SixXS 6in4 tunnel) to all servers and desktops on the LAN. A (hopefully growing) number of our users have their own IPv6 connectivity at home.

When I add the IPv6 addresses of our internal servers to our internal Bind9 DNS, some of the external users can no properly longer connect to the internal servers. I'm assuming they get an AAAA records from our DNS and their applications, having a preference for the AAAA address, try to connect directly to the server over IPv6 instead of using the IPSec tunnel. They run into our firewall and eventually time-out and connect over IPv4. In response, I've removed AAAA records from our DNS.

According to this forum post the Cisco IPSec client doesn't support IPv6, so I'd have to make the costly upgrade to AnyConnect.

Workaround that I've thought up:

  • Making a split-brain DNS that supplies AAAA records to LAN hosts, and only A records to VPN clients. VPN clients are on a specific IPv4 range, but no idea how to set up split-brain DNS.
  • Simply not providing AAAA records in internal DNS. This would limit our IPv6 usage to connections from internal clients to internet servers that advertise AAAA records. Internal traffic would remain IPv4.

Your thoughts, please? Is there a solution that would allow me to keep using IPSec VPN yet also advertise IPv6 on servers?

share|improve this question
    
What DNS server software are you using? –  justarobert Apr 16 '11 at 18:52
    
We use a Bind 9 DNS serve, as mentioned in the question. –  Martijn Heemels Apr 17 '11 at 13:46
    
Thanks. Sorry I missed that in the first place. –  justarobert Apr 17 '11 at 18:38

1 Answer 1

up vote 1 down vote accepted

While it's not the most elegant solution, you can address this problem at the DNS level by using BIND split views, which allow you to present different DNS information to different clients. Since your VPN clients are neatly segregated, the filtering will be simple. Setting up your zone files so that you don't have to make multiple entries for each server takes a little art, but is not too difficult. See this example, or the BIND9 documentation.

share|improve this answer
    
Thanks for the example. Looks like that should get me going. –  Martijn Heemels Apr 17 '11 at 19:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.