I have a situation where computers in some of our remote offices from time to time lose the ability to use our DNS server (in head office) to resolve hostnames. The offices are connected via VPN using Cisco ASA 5505 (VPNclient config rather than Site to Site) connecting back to an ASA 5510 at head office.
Ping to the IP address of the DNS server works. But nslookup will get a "no response from server" message. Computers in other locations can use DNS fine.
This is an intermittent problem. One day/hour it works, another it doesn't. Other offices connected in the same way work when another doesn't.
No config changes have been made on routers around the time we see the problem.
The DNS server that drops out for the clients is on our private address space in the 172.16.0.0/12 network. The ASA 5505s and the clients behind them are each in a 10.6.x.0/24 private address space.
Each ASA 5505 has its DHCP server configured to assign addresses and DNS config to clients behind them -these are generally Windows XP clients, with a growing number of Windows 7. The primary DNS is our one in the 172.16.0.0/12 space, the secondary is 8.8.8.8 to allow access to the internet in case the VPN tunnel drops for any reason.
Some users have reported that the problem goes away after doing a repair connection in Windows XP. I think this could be caused by the DNS cache being flushed as part of this - the Windows DNS cache makes the intermittent problem look less so because it caches failed lookups as well as successful ones. However, it is possible some other aspect of Windows is involved. Windows 7 clients have also had the same problem.
Any pointers on deeper troubleshooting, or anyone else found this?
Comments
Post a Comment