|
Question : Cisco ASA5510 - no DNS for VPN clients
|
|
I've setup a Cisco ASA5510 and VPN users are connecting properly, but they are not getting a DNS server entry.
We are using the Cisco VPN client from windows machines. When connected to the VPN, users cannot resolve names and when viewing "ipconfig /all", there is no DNS server listed. VPN users need to be able to resolve internal machine names.
Here is my config. I have the correct DNS server listed, but does it need to be listed somewhere else too?
ASA Version 7.0(5)
!
hostname ASA5510
domain-name network.com
enable password *** encrypted
names
dns-guard
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 88.218.188.88 255.255.255.248
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.168.1.252 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.99.1 255.255.255.0
management-only
!
passwd *** encrypted
ftp mode passive
dns retries 5
dns domain-lookup inside
dns name-server 192.168.1.10
access-list outside extended deny ip any any
access-list inside extended permit tcp host 192.168.1.2 any
access-list inside extended deny ip any any
access-list 101 extended permit ip 192.168.1.0 255.255.255.0 192.168.254.0 255.2
55.255.0
access-list 101 extended permit ip 192.168.2.0 255.255.255.0 192.168.254.0 255.2
55.255.0
pager lines 24
logging enable
logging buffered debugging
logging trap errors
logging history warnings
logging asdm informational
no logging message 106011
no logging message 313001
mtu outside 1500
mtu inside 1500
mtu management 1500
ip local pool clientpool 192.168.254.1-192.168.254.100
no failover
icmp permit any outside
icmp permit any inside
asdm image disk0:/asdm505.bin
no asdm history enable
arp timeout 14400
global (outside) 1 88.218.188.89
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside in interface outside
route outside 0.0.0.0 0.0.0.0 66.216.158.57 1
route inside 192.168.2.0 255.255.255.0 192.168.1.253 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server RADIUS protocol radius
aaa-server vpn protocol radius
aaa-server vpn host 192.168.1.2
key ollies123
group-policy 1group internal
group-policy 1group attributes
dns-server value 192.168.1.10
default-domain value network.com
webvpn
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set myset2 esp-des esp-md5-hmac
crypto dynamic-map dynmap 11 set transform-set myset2
crypto dynamic-map dynmap 11 set reverse-route
crypto map newmap 11 ipsec-isakmp dynamic dynmap
crypto map newmap interface outside
isakmp enable outside
isakmp policy 11 authentication pre-share
isakmp policy 11 encryption des
isakmp policy 11 hash md5
isakmp policy 11 group 2
isakmp policy 11 lifetime 1000
tunnel-group DefaultRAGroup general-attributes
authentication-server-group (outside) vpn
tunnel-group 1group type ipsec-ra
tunnel-group 1group general-attributes
address-pool clientpool
authentication-server-group vpn
tunnel-group 1group ipsec-attributes
pre-shared-key *
telnet 192.168.0.0 255.255.0.0 inside
telnet timeout 5
ssh timeout 60
console timeout 0
|
Answer : Cisco ASA5510 - no DNS for VPN clients
|
|
Try this:
tunnel-group 1group general-attributes
address-pool clientpool
default-group-policy 1group <== add this line
|
|
|
|
|
