DNS issue over Global Protect split tunnel

[ManuShankar]

I have an SFTP server. When users are inside the office they have to connect it via private IP. When they are at home they should go via public IP. I am using the same DNS server in Internal and Global Protect as well. I have excluded the private SFTP IP in Global protect split tunnel, so that users won't get connect with this IP, instead they have go over the public IP.  

Now the issues, when the users are at home they have to disable / enable the global protect, then only they will be able to connect to the SFTP server via public IP. Seems the DNS entry may be still there in the cache and it is trying to use the private IP. But they won't be able to access the server because we have excluded this private IP in the split tunnel. After performing a enable / disable, the cache may get clear and prefer to go via public IP.

Is there any solution to avoid enabling / disabling the tunnel? 

[JoergSchuetter · Accepted solution]

Hello @ManuShankar 

You could use DNS Proxy here. The DNS Proxy service is mainly forwarding the requests from GP users (keep in mind to update the GP profile as well) to your internal DNS server. But you are able to overwrite some host entries.

[ManuShankar]

Hello @JoergSchuetter 

Thanks for your quick reply, appreciate it.

I don't want to use the internal DNS, the SFTP traffic from GP VPN users should go via public IP. Let me explain; 

My DNS servers are 10.10.1.1 and 10.10.1.2 for both the internal (inside office) and for GP VPN. 

My SFTP internal IP is 10.16.10.10. The "sftp.xxx.com" resolves to 10.16.10.10 from internal network as well as GP VPN. I have configured a split tunneling and published the entire 10.16.0.0/16. Again I have configured an exclusion in the split tunnel for the IP - 10.16.10.10, to not use this IP for accessing the SFTP website from GP VPN. Instead it should use the public IP. 

Users are perfectly able to access the "sftp.xxx.com" from internal network. 

When they go home and access "sftp.xxx.com", it wont work unless they perform disable / enable the global protect.

[SutareMayur · Accepted solution]

@ManuShankar,

As mentioned by @JoergSchuetter , you can resolve your issue using DNS Proxy feature.  Under DNS proxy configuration, you can either add DNS Proxy Rule for your SFTP URL (sftp.xxx.com) and mention public DNS servers. So when GP client user will try to access your SFTP - sftp.xxx.com, request for it will go to public DNS servers mentioned under DNS Proxy Rule so requests of client will goto public IP of SFTP URL. Or you can also achieve it using adding static entries under DNS proxy configuration. You can direct add entry for SFTP URL against its public IP.

You can refer below article to get more clarity.

https://knowledgebase.paloaltonetworks.com/kCSArticleDetail?id=kA10g000000ClHf

[ManuShankar]

Thank you @SutareMayur for the detailed explanation and the document. 

In this solution I have to create DNS proxy, new security policy, NAT etc. 

I was thinking a simple solution in another way. Just changing the primary DNS IP on the GP gateway to a public IP (which resolves sftp.xxx.com to public IP) the and secondary server as my internal DNS server IP. Please help me to understand if there is any major difference with the DNS proxy.