Cisco AnyConnect client and DNS Suffixes
Posted on 2011-09-20
I'm having a problem with DNS suffixes. We have a Windows 2008 R2 server running DNS services. We have several internally hosted zones (ie. mycompany.local, mycompany.com, mycomp.com). Two of the zones (mycompany.com and mycomp.com) are also hosted externally (so our DNS is split between internal and external). It's a pain maintaining both, but that's what we have. The mycompany.local zone is our internal Active Directory domain.
While in the office, everything is fine. We have a group policy that appends all of our DNS suffixes so that we can resolve by shortname regardless of what zone the record lives in.
However, when we connect via VPN to our Cisco ASA device (using the Cisco Anyconnect client version 2.5.x), we have problems (SSL not ipsec and we do have split tunnel enabled). The ASA device hands out the correct internal DNS servers and also the default domain of mycompany.com (many of our resources are in mycompany.com internally which is why mycompany.local is not passed out instead).
However, on my domain joined workstation, when I connect to public wifi and then to VPN, I can only ping things (via shortname or unqualified name) in the mycompany.local domain. All addresses will work if we use the FQDN. Is this because my primary dns suffix is mycompany.local? Does primary dns suffix trump whatever is being passed in by the anyconnect client and ASA? I have noticed this:
The AD GPO uses the following registry key for DNS Search order:
The AnyConnect client uses this key:
The GPO we use does have mycompany.local listed first? I guess the million dollar question is why can I only resolve names to mycompany.local? I would have thought that if the anyconnect client was modifying the registry for it's own use, then it would use this key? However, it appears to be using either the machines primary dns suffix or the AD GPO suffix list (regardless, it never seems to use more than 1 domain for lookups). Is there something I can do to allow things to work as they do in the office?
I realize this was very convoluted. I can clarify if necessary.