Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a clientless VPN setup that has been working very well until recently. I found that certain sites, and mostly google domains like google.com and youtube were coming back with "Server google.com unavailible".

For a while I thought it was due to a firewall rule, or something I had done recently until I tried a site like reddit.com through the VPN and it works fine. I then tried to ping google.com from the ASA CLI and found that google.com is resolving to an ipv6 address while my entire network is still on ipv4, including my DNS servers that are set up.

I've tried not only 8.8.8.8 and my ISP's DNS servers to trouble shoot, but I've reverted my config back a few weeks and am running into the same issue with that. Does anyone have any idea how to block AAAA records from my ASA or what could be causing this? When I nslookup from my workstation I get only ipv4 answers.

share|improve this question
    
Disabling IPv6 will just put you in a world of hurt later. Avoid doing so if at all possible. Now, you don't have enough info here to work with. Exactly what is happening? –  Michael Hampton Oct 19 '12 at 15:28
    
Is the ASA delivering a AAAA response to an A query from the VPN client? That would be.. interesting. Can you clarify what system is making the request, what kind of request it is, what the exact response is, etc? –  Shane Madden Oct 20 '12 at 19:47
    
Thanks guys for the responses. Directly, I have a forwarding bind name server that queries 8.8.8.8, that is what the default DNS is set to query 10.4.0.3 in the asa. When I ping from the ASA's cli, It informs me that the address that google.com resolves to is an ipv6 address and no route to host. I believe this behaviour is the reason I can't go to google.com in the clientless VPN, but I can go to 74.125.239.3. There are a lot of sites such as reddit.com that don't result in an AAAA name and those are both pingable and browseable in the clientless VPN. –  ACiD GRiM Oct 20 '12 at 23:51
    
It's not so much that the ASA is delivering AAAA records to clients, it's that the ASA gets AAAA records itself. I'm at a loss to see how this could be possible as my whole network is ipv4 and all hosts inside do not get AAAA records with nslookup. The ipv6 address that is reported to me for google.com is: 2607:f8b0:4007:801::1002 which checks out as being owned by Google, but I could be mistaken –  ACiD GRiM Oct 20 '12 at 23:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.