VPN client to site don't much the local dns register

[ra7oub4]

Hello,

I have configured the PA-500 firewall with VPN client to site tunnels . The VPN tunnels work correctly but i can't reach the local  servers name on the DNS.

I add our local DNS address on the agent gateway setting of Global Protect without result.

Should I add another configuration to reach the record local DNS?

Thanks in advance for your collaboration.

[Chacko42]

@ra7oub4: What exactly does not work?

If you type in nslookup - is the DNS server used, you configured in the agent settings?

Do you receive a timeout?

Do you have a according security policy, which allows your GlobalProtect client zone to query the DNS server?

Can you see the dns traffic?

[ra7oub4]

Hello @Chacko42 ,

Thank you for your response .

You find below the response on your questions:

What exactly does not work? ==> we define a DNS name in our DNS server for example : intranet.com to reach the address of aour server 3.3.3.3 . With VPN connection , I can't access to the intranet.com (not response ) only the IP address reply.

If i change the file hosts on the PC  , I can't access to this dns name .

If you type in nslookup - is the DNS server used, you configured in the agent settings?

Yes , with nslookup our internal DNS response . 

Do you receive a timeout?

Yes , timeout with DNS name of server

Do you have a according security policy, which allows your GlobalProtect client zone to query the DNS server?

yes

Can you see the dns traffic?

yes I see the dns traffic on the firewall

[Chacko42]

@ra7oub4: Okay, one more idea:

If all dns queries against the server aren't working and networkwise you see no drops, it could be a server-firewall or an application-wise security mechanism (e.g. bind allow-query { networks }).

Otherwise, if the clients really reach the dns-server, you can have a look at the server-log what happens with the query or doing a packet capture if a response is send to the client (or check bytes received in traffic log)

[ra7oub4]

hello @Chacko42 ,

Thank you very much for your help . It work actually , It's a problem on the service of the security rules on the firewall.

Really thank you very much for your quick response .

Have a nice day,

[Chacko42]

@ra7oub4: no problem, glad I could help