5

We have several ASA 5505 deployed. Currently, we have a setup where the local ASA is answering DHCP queries and is configuring clients with two DNS servers: our DR site DNS server (we use AD) and a public DNS.

We need to give clients access to "the internet" when the VPN tunnel is down (this means not only packet routing but DNS answers), which rules out serving DHCP from our side. The above config allows us to use vpnclient server [Production site VPN target] [DR site VPN target] without issue.

This is a workaround from previous config where we manually failed over tunnels by adjusting the DHCP assigned DNS. Super high touch and slow.

On a Fortigate, there was a load balancing service that would create a VIP and had some checks ot verify connectivity to DNS servers.

Beyond a creative solution like load balancing, how can we configure clients that are assigned DHCP by our field ASAs to send DNS lookups to specific servers?

[side note]

Just thought that we might use load balancers at each site that serve DNS via the same VIP (only accessible by VPN clients). But this is a complex server-side solution for a possible client-side problem.

Improve this question
1
  • 1
    How does having the alternate DNS server not suffice? Windows should use the public (secondary) DNS automatically when the internal one is no longer available. Could you clarify the problem a bit?
    – pxed
    Mar 4, 2015 at 22:20

1 Answer 1

Reset to default
2
+100

In your situation I would simply use the ASA as a DHCP that hands out its internal IP as the DNS server, use DNS proxy to the tunnel DNS and have several public DNS's listed in the config.

EG. (these commands work on c3900 equipment ios15.1, you may have to make changes to be compatible to the ASA software)

service dhcp
ip domain nameserver "tunnel dns"
ip domain nameserver 8.8.8.8 ; google dns used for simplicity
ip domain nameserver 8.8.4.4
ip dhcp pool NET-POOL
   network 192.168.1.0 255.255.255.0
   default-router 192.168.1.1
   dns-server 192.168.1.1
   domain-name mydomain.net ; not required but helpful
   lease 9
ip dhcp excluded-address 192.168.1.1

this works for small offices, I use it on 100 users or less, but could be scaled if you have the ram.

Running an ip-sla on the tunnel to know when its down and use the default route to point to the tunnel would make the switchover faster and more reliable. Just make sure you have a static route defined to point to the local outside interface or when the tunnel goes down, the asa will remove the default route and then things could just stop working.

Improve this answer
6
  • This answers my question, is client-side, and should work as expected. Can you append ip sla config if you have an example? That will weight correctly to "failback" when the original VPN server is once against reachable, right?
    – brandeded
    Mar 9, 2015 at 20:11
  • ip sla 1 icmp-echo 192.168.150.2 frequency 4 timeout 2000 threshold 100 ip sla schedule 1 life forever start-time now
    – Random-IT
    Mar 12, 2015 at 23:28
  • * add static routes first * ip route 0.0.0.0 0.0.0.0 2.2.2.2 ip route 0.0.0.0 0.0.0.0 3.3.3.3 10 ip sla 1 icmp-echo 2.2.2.2 source-interface Tunnel1 timeout 1000 threshold 2 frequency 3 ip sla schedule 1 life forever start-time now track 1 ip sla 1 reachability * you must do this after or it wont work * ip route 0.0.0.0 0.0.0.0 2.2.2.2 track 1 ip route 0.0.0.0 0.0.0.0 3.3.3.3 10
    – Random-IT
    Mar 12, 2015 at 23:35
  • sorry for the first comment, I was distracted during writing it.
    – Random-IT
    Mar 12, 2015 at 23:35
  • 1
    only for the first 5mins, when the baby cries it can be more than 5mins before you can get back :P
    – Random-IT
    Mar 13, 2015 at 19:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .