Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
05-27-2021 08:57 AM
Our GlobalProtect firewalls are running version 8.1.15 and another 9.1.4. We allow Split Tunnel, and one firewall has a 0.0.0.0/0 Include Access Route, and the other does not. Both don’t have any Excluded routes. The one firewall (9.1.4) does have a Domain and Application Entry, Excluding *.webex.com and webex.com domain for testing this feature.
Both firewalls, the GP App Config settings are: Split-Tunnel Option: Network Traffic Only and Resolve All FQDNs using DNS servers Assigned by the Tunnel: Yes; both are default and have not changed.
About six months ago, we upgraded our GP clients from version 2.0.2 or 4.0.x to 5.0.8, and most are now on 5.2.3. We’ve noticed some DNS issues with some specific situations since the upgrade from 2.0.2 or 4.0.x.
Problem 1: We have a handful of users who use GP to VPN to our network and, when needed, connect to an outside vendor’s VPN (Anyconnect) to access data at the vendor while still on our VPN (due to a vendor whitelist). When they connect to the vendor, the users cannot access their server or ours. Testing one user, we notice we can ping our internal DNS server or others, but DNS requests are not working. Using Wireshark and capturing the local, GP, and AnyConnect interfaces and filtering on port 53, there is no DNS traffic at all. At the command prompt using nslookup and using multiple DNS servers, there is no port 53 traffic. Also, checking the firewall, there is no port 53 traffic during this time. Both our VPN and the vendor have Split-tunneling allowed.
Problem 2: On the GP gateway with the Domain Exclusion of webex.com, when a test user connects, they can access other sites, but webex.com won’t load. Using Wireshark and capturing the GP and local interfaces, I see reply DNS traffic from our internal DNS server to the user, but I don’t see the request from the user to the DNS server. Also, I see traffic for webex.com but trying to use both the GP and local interfaces. We did upgrade the GP client to version 5.2.6.
Were there significant DNS behavior changes from our previous GP versions of 2.0.2 or 4.0.x to 5.0.8, which may account for the strange issues we are experiencing?
Thank you for any help.
Jeff
