×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

IOS Split tunneling DNS querys

Unanswered Question
Oct 20th, 2014
User Badges:

Hi, I am unable to get my 891 router connected by EZVPN to an ASA to resolve DNS querys to the corporate DNS server.

It appears that the DNS queries are not being placed into the tunnel, but instead are using the outside address of the routers.

This leads me to believe that the command domain name-server interface vlan1 is not working.

interface GigabitEthernet0
 ip address dhcp
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 duplex auto
 speed auto
 crypto ipsec client ezvpn xxxxxASA

interface Vlan1
 description Home Network Inside
 ip address 172.17.64.1 255.255.255.0
 ip tcp adjust-mss 1452
 crypto ipsec client ezvpn xxxxxASA inside

ip dns view default
 logging
 domain name x.y.on.ca
 domain name-server  192.1.10.254
 domain name-server interface Vlan1

ip dns server

 

I can see by looking at the crypto map nothing is being encapsulated as a result of a name query.

It should be going into this crypto map

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (172.17.64.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.1.10.0/255.255.255.0/0/0)

but the count remains as below

    #pkts encaps: 25, #pkts encrypt: 25, #pkts digest: 25
    #pkts decaps: 25, #pkts decrypt: 25, #pkts verify: 25

with no other counter incrementing.

A ping or telnet from a device on 172.17.64.0 works fine and causes those counters to increment so the tunnel is working.

I can even ping from the router using the source opton on the ping command.

Once in all my attempts to troubleshoot I got the name query to use the tunnel.

Any help is greatly appreciated.

I even tried

ip domain lookup source-interface Vlan1

but that does not work either.

Code is 15.2(4)M6.

debug ip packet 100 that permits 192.1.10.254 in both directions shows the packet going out from the Gi0 ip address.

 

 

 

 

 

 

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.

Actions

This Discussion