DNS issue over Global Protect split tunnel

[ManuShankar]

I have an SFTP server. When users are inside the office they have to connect it via private IP. When they are at home they should go via public IP. I am using the same DNS server in Internal and Global Protect as well. I have excluded the private SFTP IP in Global protect split tunnel, so that users won't get connect with this IP, instead they have go over the public IP.  

Now the issues, when the users are at home they have to disable / enable the global protect, then only they will be able to connect to the SFTP server via public IP. Seems the DNS entry may be still there in the cache and it is trying to use the private IP. But they won't be able to access the server because we have excluded this private IP in the split tunnel. After performing a enable / disable, the cache may get clear and prefer to go via public IP.

Is there any solution to avoid enabling / disabling the tunnel? 

[JoergSchuetter · Accepted solution]

Hello @ManuShankar 

You could use DNS Proxy here. The DNS Proxy service is mainly forwarding the requests from GP users (keep in mind to update the GP profile as well) to your internal DNS server. But you are able to overwrite some host entries.

[ManuShankar]

Hello @JoergSchuetter 

Thanks for your quick reply, appreciate it.

I don't want to use the internal DNS, the SFTP traffic from GP VPN users should go via public IP. Let me explain; 

My DNS servers are 10.10.1.1 and 10.10.1.2 for both the internal (inside office) and for GP VPN. 

My SFTP internal IP is 10.16.10.10. The "sftp.xxx.com" resolves to 10.16.10.10 from internal network as well as GP VPN. I have configured a split tunneling and published the entire 10.16.0.0/16. Again I have configured an exclusion in the split tunnel for the IP - 10.16.10.10, to not use this IP for accessing the SFTP website from GP VPN. Instead it should use the public IP. 

Users are perfectly able to access the "sftp.xxx.com" from internal network. 

When they go home and access "sftp.xxx.com", it wont work unless they perform disable / enable the global protect.

[SutareMayur · Accepted solution]

@ManuShankar,

As mentioned by @JoergSchuetter , you can resolve your issue using DNS Proxy feature.  Under DNS proxy configuration, you can either add DNS Proxy Rule for your SFTP URL (sftp.xxx.com) and mention public DNS servers. So when GP client user will try to access your SFTP - sftp.xxx.com, request for it will go to public DNS servers mentioned under DNS Proxy Rule so requests of client will goto public IP of SFTP URL. Or you can also achieve it using adding static entries under DNS proxy configuration. You can direct add entry for SFTP URL against its public IP.

You can refer below article to get more clarity.

https://knowledgebase.paloaltonetworks.com/kCSArticleDetail?id=kA10g000000ClHf

[ManuShankar]

Thank you @SutareMayur for the detailed explanation and the document. 

In this solution I have to create DNS proxy, new security policy, NAT etc. 

I was thinking a simple solution in another way. Just changing the primary DNS IP on the GP gateway to a public IP (which resolves sftp.xxx.com to public IP) the and secondary server as my internal DNS server IP. Please help me to understand if there is any major difference with the DNS proxy. 

[SutareMayur]

@ManuShankar,

DNS Proxy will be more controlled as it will be applicable to your SFTP URL and/or the URLs only which are mentioned under DNS proxy configuration.

[Abdul-Fattah]

Hi @ManuShankar ,

if the problem with DNS, what already @SutareMayur @JoergSchuetter said, DNS Proxy can be a solution for you.

but what does not make sense yet, what do you mean with enable/disable ? do they disable GP then connect to SFTP public? then re-enable VPN tunnel? 

because if you mean with disable/enable = re-establishing the connection SFTP should also not work. unless the windows DNS Cache is beeing fushed here. which you can also edit cache timeout to solve your problem.

if that is the case that GP should be disabled first, i will asume you internet traffic for homeoffice users go through the tunnel, right?

the behavoir you discribed could be linked that they are going throguh the tunnel to reach your SFTP Public-ip, and when they disconnect the use the private Internet.

[ManuShankar]

Hi @Abdul-Fattah , 

As per my understanding if I create a DNS proxy then all DNS request from the VPN clients will come to Firewall IP, which I don't want. Firewall will act in the middle for all the request. 

I am with your point, re-establishing VPN connection, SFTP should also not work. unless clearing the windows DNS Cache. Actually this is told by user, honestly I couldn't check from user's machine. 

 do you have any idea how to edit cache timeout? 

Thanks,

Manu

[Abdul-Fattah]

Hi @ManuShankar,

you can edit the windows registry to change the default of 1 Day.

but as far as i know windows handels DNS very well, and store only valid DNS, so that should not be the problem. but you will need to check this behavior further as i mentined the problem could be that the GP-users internet traffic going through the tunnel, because ive seen this before in my case the traffic was going thoruhg the tunnel to the internet which gave the users a Public ip that it can not reach the other service (in your case SFTP Public IP).