APM - Allow Local DNS Servers - Actual Usage

Hi All,

 

Intrigued how this setting behaves "Allow Local DNS Servers" as it doesn't seem to do what it says.

 

Help is ambiguous...

 

"Check this box to enable local access to DNS servers configured on client prior to establishing network access connection."

 

Scenario we have... The internal DNS server needs to resolve a certain zone, but the clients own DNS should resolve all other queries.

 

DNS Address Space inclusion is for internal zone. Allow local DNS Servers enabled.

 

DNS/Host section has two internal DNS servers configured.

 

But it's just not working.

 

Any ideas?

 

Response to Seth Cooper (F5)

Can you confirm if the DNS Relay Proxy service is installed on the client?

 

I can confirm the DNS Relay Proxy is installed on the client, and that we used CTU to check that.

 

Do you have split or full tunnel configured?

 

Split tunnel is configured.

 

If split tunnel are the DNS servers configured in the allowed IPs?

 

Yes, IP ranges include the internal DNS servers to query.

 

Can you post a little bit more information about your actual configuration?

 

The APM Network Access is configured for third parties to access select systems via a VPN (can't be delivered by other APM resources).

 

For purpose of this, let's refer to the internal DNS zone as lab.int.

 

A client would expect to connect to the VPN and be able to resolve queries for lab.int. against the internal DNS provided over the VPN.

 

As the DNS Server is not recursive, and serves only lab.int. all other queries need to be locally resolved by the clients own DNS servers.

 

How it's configured...

 

The network access resource is configured to split tunnel and has a block of IP address ranges (which covers the DNS servers). The DNS servers are provided under the DNS/HOSTS section, along with the default dns suffix of lab.int.

 

Also under the network settings section, the include DNS addresses has *.lab.int. and no exclusions (IP or DNS).

 

Now we're looking at this "Allow local DNS servers" and need clarity over it's usage, because it sounds like it fills the requirement, but it's unclear what it actually does and isn't in the documentation.

 

Effectively, we're trying to make use of the DNS Relay Proxy to resolve only the internal zone.