Re: Help With DNS Through VPN

> What I meant was "merry.christmas" is NOT the name of the DNS/SBS server.

Be that as it is... that is how the DNS server seems to resolve itself. You
probably have a reverse lookup zone on your DNS server that has a PTR record
of "merry.christmas" for the external IP address. Let's forget about this
for now, it's really not that important.

> I mean that if I try to, say, make a Desktop Shortcut on the remote PC to
> \\internal_servername\share_name it fails because I can't resolve any
> hosts on that network.

No that's not why it fails. And this is completely different from a simple
DNS query. You are trying to work as you were in the LAN. In order for
Windows Networking to work like that you need a whole lot of things to
happen first, which in your case don't happen and never will - read on for
details.

> Worse, I can't ping anything on that network either. Is this because of
> NAT between the external and internal interfaces?

Yes.

>> Finally, what happens if you install INetQuery on a remote PC, connect
>> that PC via VPN, then launch some DNS queries from that PC against the
>> external SBS IP?
>>
> If I try to ping <FQDN> of the DNS/SBS server I get 8 "Host timed out":
> the first one blank and the other seven with DNS server IP and host name.

But you do get the IP correctly from the FQDN. All this while using the
external SBS IP as your DNS server in INetQuery, correct? If yes then we got
past the initial problem of making the DNS server on the external SBS NIC
available to VPN clients. Similarly if you ping the FQDN of one of the hosts
on the internal LAN you will see it's being resolved correctly, but PING
doesn't go through - because of NAT and your entire topology.

Now on to the "real" issue here which is the fact that you don't have
communication between the Cisco VPN clients and your ISA server. I am sorry
to tell you that you will never be able to do this with ISA2000, unless you
create a separate network between your Cisco VPN server and a 3rd NIC on the
SBS machine configured as a DMZ network. This is probably too complicated
anyway so if I were you I would do one of two things:
-Either configure ISA as the VPN server and logon directly to ISA; then
remote clients will have no problem connecting to the internal LAN. This
would be my preffered method. Most likely you would have to start using the
Microsoft VPN client though; it can also be done with the Cisco VPN client
but it is very complicated and unreliable in my experience.
-Or, bring ISA in the front, as your "edge" device with a public IP and
direct connection to Internet, and place the "internal" interface of your
Cisco VPN concentrator on the LAN, so that when remote clients log on to the
VPN provided by Cisco, they are "on the LAN" already.

Other than that... not much to do. Keyword here is topology re-design...
there's really no workaround to that.

Good luck,
Virgil


.

Relevant Pages

  • Re: Name resolution for VPN Clients
    ... using an IP that is part of the VPN client's normal "local" network ... A local network is a network-cheaper name lookup than any VPN connection. ... define the "local" DNS server to be one provided by your ISP ... permanent LAN Client or a VPN User. ...
    (microsoft.public.isa.vpn)
  • Re: Name resolution for VPN Clients
    ... controlled by the ISA when connected by VPN etc. ... intents and purposes the internal DNS server does indeed to be resolving the ... The Internet Device should never be involved in any ... Understanding the ISA 2004 Access Rule Processing ...
    (microsoft.public.isa.vpn)
  • Re: Strange DNS
    ... >> You are trying to lookup a resource located in your office. ... the ISP DNS server is not able to locate the record. ... >> inside your office are now tunnelled through the VPN connection. ...
    (microsoft.public.win2000.dns)
  • Re: VPN Clients DNS Issue
    ... The problem is the way that Windows XP has the network adapters bound. ... this the DNS will resolve correctly when you are connected to a VPN. ... the client it shows that the default DNS server is the DNS server that is ... but the VPN client was still resolving to the external IP. ...
    (microsoft.public.windows.server.dns)
  • Re: DNS not resolving correctly on VPN
    ... When they log in via VPN, we pass the same DNS server. ... I will work with one of this machines today and post back. ... > the users use the OWA from the Internet side? ...
    (microsoft.public.win2000.dns)