topic Re: PA500 split tunnelling DNS question in General Topics

PA500 split tunnelling DNS question

sue_town — Tue, 30 Aug 2011 12:27:33 GMT

Have a PA 500 set up for split tunnelling - so clients access internet locally and all other traffic is passed over VPN tunnel to our office

I have DHCP set up on PA box so clients get primary DNS server (local ISP one) and secondary DNS (office one)

I have set up a rule from trust to untrust to allow application DNS and service DNS however i am getting errors saying failed to resolve domain name

so I SSH to the box and cannot ping host www.yahoo.com nor can i ping host yahoo.com by IP

any ideas please?

thanks

Sue

Re: PA500 split tunnelling DNS question

jleung — Tue, 30 Aug 2011 13:02:41 GMT

Hi,

if you cannot ping yahoo.com by IP as well, it is unlikely to be a DNS problem. Would you check the traffic log to see if any traffic has been denied?

Re: PA500 split tunnelling DNS question

sue_town — Tue, 30 Aug 2011 13:11:39 GMT

I am seeing traffic denied from untrust to untrust per my last global deny rule application not applicable

dosent seem to be any other deny

thanks

Sue

Re: PA500 split tunnelling DNS question

jleung — Tue, 30 Aug 2011 13:34:54 GMT

Hi Sue,

Try to do this:

1. go to whatismyipaddress.com/ to check the public IP you are using before you connect to the SSLVPN.

2. start the vpn connection, check if there is any deny traffic from your public ip address

3. most likely you will see there is traffic from your public IP address from untrust to untrust running on port 443 being denied. for that case you should add the SSL as the app and app. default as the port no.

4. remember to add the NAT policy for your client.

Re: PA500 split tunnelling DNS question

sue_town — Tue, 30 Aug 2011 13:44:02 GMT

thanks for your reply....but the traffic over the VPN tunnel into the companys network is working ok

the issue is just with internet access and DNS it seems...

Sue

Re: PA500 split tunnelling DNS question

jleung — Tue, 30 Aug 2011 14:34:14 GMT

Hi Sue,

so would you run ipconfig to see if the DNS setting is well populated? Also check if the "route print" output to see if the routing to SSLVPN gateway just cover the corporate network subnet, and run a traceroute to see check which is the next hop for traffic to yahoo.com.

Re: PA500 split tunnelling DNS question

sue_town — Wed, 31 Aug 2011 07:57:59 GMT

just to let you know this is resolved

the issue was that the default route was set to go via an interface rather than IP address - once i changed it to IP, all web browsing and DNS worked fine

just for info

thanks for replies

Sue

Re: PA500 split tunnelling DNS question

jleung — Wed, 31 Aug 2011 15:49:31 GMT

Hi Sue,

Good to know that