We have large number of branch offices connected via VPN, but without any kind of server infrastructure. The client machines in each office get their network configuration from an ASA 5505, which is also used for the VPN connection.
The Windows XP client machines are configured to use one of our corporate DNS servers as the primary, with the DNS server of the ISP as the secondary. The idea is that if the VPN connection fails for any reason, staff in the office will still be able to access the internet, and access our webmail and home access portal. In the majority of cases this works fine.
However, for offices based in South America we are seeing DNS resolution on the client machines regularly being done against the ISP DNS server - this results in our corporate resources being effectively unavailable to staff in the offices.
The client machines are able to ping the corporate DNS server ok. When doing an nslookup of a corporate hostname, I get a reply.
I'm thinking one of the following (or a combination) is happening:
- our corporate DNS server is not always replying to requests in a timely fashion (although why this would only affect clients in one geographic region I don't know)
- DNS queries from Latin America are somehow delayed, causing the client to treat it as failed (although we have offices at the end of much slower VSAT connections which do not have this issue)
- a single failure is resulting in a DNS cache entry in Windows that somehow results in the lookups not happening on subsequent tries
Has anyone else come across this issue? Any ideas for resolutions?