Forum Discussion

a_basharat_2591's avatar
a_basharat_2591
Icon for Nimbostratus rankNimbostratus
Jun 06, 2018

SSL VPN - Enforce DNS search order

Hi,

 

On the SSL VPN, What does it mean "Enforce DNS search order" on the DNS/Hosts Tab of it?

 

I am using split tunnel for the SSL VPN, so should that box be ticked or unticked?

 

Thanks

 

APM
BIG-IP
devops
security
ssl vpn

1 Reply

Sort By
  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Jun 06, 2018

    Hi,

    Response from F5:

    If you look at the IPv4 properties of the PPP adapter that is created you should see the DNS servers listed. You should also see them if you type in "ipconfig /all" at a command prompt (assuming Windows client).

    For the Enforce DNS search order it is described as:
When this setting is enabled, APM continuously checks the DNS order on the network interface, 
and sets the network access-supplied entries first in the list if they change during a session. 
To use your local DNS settings as primary and the network access-supplied DNS settings as secondary, 
clear this setting. This might be useful when split tunneling is in use and the client connects 
remotely.

    So as you can see this is used to keep the tunnel DNS servers as a higher priority than your local DNS.

    For the Static Hosts it is described as: 

    Type IP address and host name pairs to specify static hosts.

    This is basically just adding entries to the local hosts file of the client for name resolution. You would use this for instances where you don't have the entry in DNS.

    FYI: https://devcentral.f5.com/questions/dns-entry-in-the-apm