Project

General

Profile

Issue #3603

dns issue in config mode

Added by Eric Eric P. about 1 month ago. Updated about 1 month ago.

Status:
Feedback
Priority:
Normal
Assignee:
-
Category:
configuration
Affected version:
5.8.2
Resolution:

Description

Hello,

Below is my configuration that I use to connect my nomade pc to a Stormshield firewall throught an ipsec tunnel.

As you can see, I m using config mode on the firewall to obtain the ip in the tunnel and dns ip.

With this configuration, tunnel is up sucessfully.

I obtain a leftsourceip dynamicaly and I can join some server through the tunnel by ip.

My issue is to obtain the DNS dynamicaly and use it to join some server through the tunnel.

I m not sur about the syntaxe to use and my dns configuration (by config mode of the tunnel) do not work.
When tunnel is up, how can I use the dns of the tunnel and not the local dns.

Thank a lot for your help.

Regards

Eric

# basic configuration

config setup
        charondebug="cfg 4, ike 4, knl 3, mgr 3, lib 3" 
conn myconnexion
     leftsubnet=%dynamic,10.133.0.0/20
     leftsourceip=%config
     leftcert=XXXXXXXXXXXXXXXX.pem
     leftid="C=FR, O=XXXXXXXXXXXXXXXXX, OU=0002 XXXXXXXXX, OU=SERVEURS, CN=XXXXXXXXXXXXXXXX.fr" 
     leftdns=%config4,%config6
     right=myfirewall@ip
     rightsubnet=10.0.0.0/8
     authby=rsasig
     rightid=%any
     rightsendcert=never
     ike=aes256-sha256-modpXXXX
     esp=aes256-sha256-modpXXXX
     keyexchange=ikev2
     ikelifetime=8h
     lifetime=1h
     auto=route

Note that tunnel processing to up the turn up the tunnel seems to be slow with this configuration.

History

#1 Updated by Tobias Brunner about 1 month ago

  • Status changed from New to Feedback

I m not sur about the syntaxe to use and my dns configuration (by config mode of the tunnel) do not work.

If you request a virtual IP, leftdns has no effect, depending on the loaded plugins (DNS servers are usually requested automatically if a virtual IP is requested).

When tunnel is up, how can I use the dns of the tunnel and not the local dns.

Read the log and make sure the server actually sends a DNS server. If the server does not send one, you can't do anything about it (except perhaps configuring a custom DNS server locally via updown script). If it does, make sure you have a plugin that actually installs the DNS server locally (e.g. the resolve plugin).

Also available in: Atom PDF