1

Looking for some help with our Office's VPN that I can't seem to solve...

I am trying to remote desktop to the Work PC from Home PC via the DC ASA 5506-x VPN. I can only connect to the Work PC with IP Address or FQDN, but hostnames do not resolve.

![network](https://pasteboard.co/[![networkdiagram][1]

Hardware/Software model:

  • Windows Server 2012 R2 Standard hosting DNS server version 6.3.9600.17238
  • DC Cisco 5506-x firewall hosting VPN
  • DC Cisco 5506-x firewall Cisco asdm image asdm-7101.bin
  • DC Cisco 5506-x firewall boot system asa982-20-lfbff-k8.spa

The hostnames and intranet sites all resolve perfectly in the office, just that when we connect via VPN it does not work. I have played around with our firewall and made sure it's DNS server is configured to the IP address of our windows server but none of these work.

My question is, how do I troubleshoot the DNS issue? how do I get DNS to resolve when connected through VPN?

: Hardware:   ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
:
ASA Version 9.8(2)20
!
no mac-address auto
ip local pool DC_REMOTE_VPN_POOL 10.111.10.50-10.111.10.100 mask 255.255.255.0

!
boot system disk0:/asa982-20-lfbff-k8.SPA
boot system disk0:/asa961-lfbff-k8.SPA

dns domain-lookup inside
dns server-group DefaultDNS
 name-server 10.111.1.1 inside 
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object-group network DC_REMOTE_VPN
 network-object 10.111.10.0 255.255.255.0
object-group network INT
 network-object 10.111.0.0 255.255.0.0
object-group network OFF_INT_NETS
 network-object 10.110.0.0 255.255.0.0
object-group network OFF_REMOTE_VPN_NETS
 network-object 10.110.10.0 255.255.255.0
access-list outside_access_in extended permit icmp any any echo-reply
access-list outside_access_in extended permit icmp any any unreachable
access-list outside_access_in extended permit icmp any any time-exceeded
access-list outside_access_in extended permit icmp any any parameter-problem
access-list DC_REMOTE_VPN_splitTunnelAcl standard permit 10.111.1.0 255.255.255.0
access-list DC_REMOTE_VPN_splitTunnelAcl standard permit 10.111.9.0 255.255.255.0
access-list DC_REMOTE_VPN_splitTunnelAcl standard permit 10.111.3.0 255.255.255.0
access-list DC_REMOTE_VPN_splitTunnelAcl standard permit 10.112.0.0 255.255.0.0
access-list DC_REMOTE_VPN_splitTunnelAcl standard permit 10.111.0.0 255.255.0.0
access-list DC_REMOTE_VPN_splitTunnelAcl standard permit 10.110.0.0 255.255.0.0
access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
access-list AnyConnect_Client_Local_Print remark Windows' printing port
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353
access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355
access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns
mtu outside 1500
mtu inside 1500
mtu firepower_MGT 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-7101.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (any,any) source static DC_REMOTE_VPN_NETS DC_REMOTE_VPN_NETS destination static OFF_INT_NETS OFF_INT_NETS no-proxy-arp
nat (inside,outside) source static DC_INT_NETS DC_INT_NETS destination static DC_REMOTE_VPN_NETS DC_REMOTE_VPN_NETS no-proxy-arp
nat (inside,outside) source static DC_INT_NETS DC_INT_NETS destination static OFF_INT_NETS OFF_INT_NETS no-proxy-arp
nat (inside,outside) source static DC_INT_NETS DC_INT_NETS destination static OFF_REMOTE_VPN_NETS OFF_REMOTE_VPN_NETS no-proxy-arp
!
object network obj_any
 nat (inside,outside) dynamic interface
!
nat (inside,firepower_MGT) after-auto source dynamic any interface
access-group outside_access_in in interface outside
route inside 10.110.0.0 255.255.0.0 10.111.9.201 10 track 1
route inside 10.111.0.0 255.255.0.0 10.111.9.201 1
route inside 172.16.1.0 255.255.255.252 10.111.9.201 1
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
aaa authentication telnet console LOCAL
aaa authentication login-history
snmp-server enable traps entity config-change
sla monitor 172
 type echo protocol ipIcmpEcho 172.16.1.2 interface inside
 num-packets 5
 timeout 10000
 frequency 30
sla monitor schedule 172 life forever start-time now
service sw-reset-button
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev2 ipsec-proposal ikev2-ESP-AES256-SHA1
 protocol esp encryption aes-256
 protocol esp integrity sha-1
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map DC_REMOTE_VPN_dyn_map 20 set ikev1 transform-set ESP-3DES-MD5
crypto map vpn 10 match address VPN2OFF
crypto map vpn 10 set pfs
crypto map vpn 10 set peer 103.241.91.91 103.241.91.112
crypto map vpn 10 set ikev1 transform-set ESP-3DES-MD5
crypto map vpn 65535 ipsec-isakmp dynamic DC_REMOTE_VPN_dyn_map
crypto map vpn interface outside
crypto ca trustpoint _SmartCallHome_ServerCA
 no validation-usage
 crl configure
crypto ca trustpool policy
crypto ikev2 policy 20
 encryption aes-256
 integrity sha
 group 14
 prf sha
 lifetime seconds 86400
crypto ikev2 enable outside
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400
crypto ikev1 policy 20
 authentication pre-share
 encryption aes-256
 hash sha
 group 5
 lifetime 86400
!
track 1 rtr 172 reachability
telnet timeout 5

dhcpd auto_config outside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 10.111.1.1
ntp server 203.129.68.14
ssl cipher default low
ssl cipher tlsv1 low
ssl cipher tlsv1.1 low
ssl cipher tlsv1.2 low
ssl cipher dtlsv1 low
group-policy DC_REMOTE_VPN internal
group-policy DC_REMOTE_VPN attributes
 dns-server value 10.111.1.1
 vpn-tunnel-protocol ikev1
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value DC_REMOTE_VPN_splitTunnelAcl
 default-domain value test.local
 split-tunnel-all-dns enable
dynamic-access-policy-record DfltAccessPolicy
tunnel-group DC_REMOTE_VPN type remote-access
tunnel-group DC_REMOTE_VPN general-attributes
 address-pool DC_REMOTE_VPN_POOL
 authentication-server-group ADC01 LOCAL
 default-group-policy DC_REMOTE_VPN
tunnel-group DC_REMOTE_VPN ipsec-attributes
 ikev1 pre-shared-key *****
tunnel-group 103.241.91.91 type ipsec-l2l
tunnel-group 103.241.91.91 ipsec-attributes
 ikev1 pre-shared-key *****
tunnel-group 103.241.91.112 type ipsec-l2l
tunnel-group 103.241.91.112 ipsec-attributes
 ikev1 pre-shared-key *****
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
  • Can you add the make and model of the firewall and the (anonymized) VPN configuration? – RobinG Mar 5 at 9:46
  • Please edit your question to include things like a good network description or diagram, the network device models, and the network device configurations. You can refer to the Network Engineering Question Checklist for guidance, then edit the questions. We could only guess or speculate what the problem is, and that is off-topic here. Also, host/server configurations are off-topic here, and you can ask about those on Server Fault for a business network. – Ron Maupin Mar 5 at 14:56
  • Thanks RobinG and Ron. Sorry I am fairly new to the Cisco ASAs, but I do have privileged access to it and has played around with it for a little bit. Kindly let me know how I can get the VPN configuration that you are asking for, I assume with a "show" command? – Jeff Mar 6 at 1:14
  • 1
    Your configuration is missing your interfaces, so we can't see what's configured. That being said, your DNS server is on a subnet you don't have a static route for, so if you don't have a connected route or a dynamic route, you have no way to hit your DNS server from that ASA. – Jesse P. Mar 21 at 4:00
  • Assuming that Windows home PC, first of all check after connecting that ipconfig /all shows the correct DNS address that you configured under the group policy If that is correct then I'd move onto the inside interface of you ASA and make sure the DNS is getting through - you can check this with a capture: capture CAP input inside match udp 10.111.10.0 255.255.255.128 10.111.1.1 eq 53 then at a later date show capture this will verify if the traffic is coming through to the inside interface. If it is coming through the inside interface but not returning then investigate the DNS server for rou – Owensteam Mar 21 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.