Forum Discussion

JD1's avatar
JD1
Icon for Altostratus rankAltostratus
Nov 12, 2015

APM - Allow Local DNS Servers - Actual Usage

Hi All,

 

Intrigued how this setting behaves "Allow Local DNS Servers" as it doesn't seem to do what it says.

 

Help is ambiguous...

 

"Check this box to enable local access to DNS servers configured on client prior to establishing network access connection."

 

Scenario we have... The internal DNS server needs to resolve a certain zone, but the clients own DNS should resolve all other queries.

 

DNS Address Space inclusion is for internal zone. Allow local DNS Servers enabled.

 

DNS/Host section has two internal DNS servers configured.

 

But it's just not working.

 

Any ideas?

 

Response to Seth Cooper (F5)

Can you confirm if the DNS Relay Proxy service is installed on the client?

 

I can confirm the DNS Relay Proxy is installed on the client, and that we used CTU to check that.

 

Do you have split or full tunnel configured?

 

Split tunnel is configured.

 

If split tunnel are the DNS servers configured in the allowed IPs?

 

Yes, IP ranges include the internal DNS servers to query.

 

Can you post a little bit more information about your actual configuration?

 

The APM Network Access is configured for third parties to access select systems via a VPN (can't be delivered by other APM resources).

 

For purpose of this, let's refer to the internal DNS zone as lab.int.

 

A client would expect to connect to the VPN and be able to resolve queries for lab.int. against the internal DNS provided over the VPN.

 

As the DNS Server is not recursive, and serves only lab.int. all other queries need to be locally resolved by the clients own DNS servers.

 

How it's configured...

 

The network access resource is configured to split tunnel and has a block of IP address ranges (which covers the DNS servers). The DNS servers are provided under the DNS/HOSTS section, along with the default dns suffix of lab.int.

 

Also under the network settings section, the include DNS addresses has *.lab.int. and no exclusions (IP or DNS).

 

Now we're looking at this "Allow local DNS servers" and need clarity over it's usage, because it sounds like it fills the requirement, but it's unclear what it actually does and isn't in the documentation.

 

Effectively, we're trying to make use of the DNS Relay Proxy to resolve only the internal zone.

 

APM
availability
security

3 Replies

Sort By
  • Seth_Cooper's avatar
    Seth_Cooper
    Icon for Employee rankEmployee
    Nov 13, 2015

    Can you confirm if the DNS Relay Proxy service is installed on the client? Do you have split or full tunnel configured? If split tunnel are the DNS servers configured in the allowed IPs? Can you post a little bit more information about your actual configuration?

     

  • Seth_Cooper's avatar
    Seth_Cooper
    Icon for Employee rankEmployee
    Nov 13, 2015

    The Allow Local DNS setting and the Allow Local Subnet settings are really only needed if you are using full tunnel or if your split tunnel will overlap the IP ranges needed on the local subnet. These basically just create routing exceptions.

     

    Your issues seems to be with the DNS Relay Proxy. Please make sure you have the DNS Address Space settings configured correctly. Can you review this SOL? https://support.f5.com/kb/en-us/solutions/public/9000/600/sol9694.html

     

    If you are still having issues you can certainly open a case with F5 Support. Please provide the CTU report (f5wininfo.exe) from the client and a qkview from the APM.

     

    Seth