Hi,
I'm wondering if this is even possible... We use a Hub and spoke auto VPN Meraki configuration where the central hub(s) host all manner of services but also the central DNS servers for client/spoke Meraki sites as Azure VMs/DCs. All the corporate VLANs on the spoke sites are configured to use these name servers (2 x in main hub and 2 x for the DR hub - both Azure hosted).
In normal operation we want the corporate DNS to be used for these users (other VLANs for guest users and guest wi-fi have the Public/DNS option selected) but corporate users need to use the internal DNS as it has private DNS mappings for internal only services (and uses DNS forwarding/Azure DNS after that to onward resolve public Internet IPs it doesn't know about itself). This gives the corporate users full DNS resolution for internal/private URLs as well as the public Internet.
During the recent outage issues with Auto VPN (a Meraki central issue last week) this took down our primary SD-WAN tunnel to the master Hub but failover/DR did not kick in for the backup as it was an external Meraki mapping issue... This meant corporate users could not connect to internal resources (via the Auto VPN) which is understandable but they were equally then prevented from being able to access anything like cloud/local breakout services including Office 365/Teams etc. as they could not resolve hostnames via central DNS and the custom name servers (as the tunnel was down). This meant a manual comms out to those who happened to be on the Guest-Wi-Fi already to say to corporate users to switch across to that in the meantime until it was fixed (not very elegant).
Is there a way of configuring DNS in Meraki to prevent against this scenario and have public DNS as a backup in the custom name servers for the corporate VLANs at the branch sites? I know they won't be able to resolve or connect to central private hostnames if ever this scenario happens again but I think just adding the extra public DNS IPs to the end of the list of Custom Name Servers is a no go for normal BAU operation (as Google DNS may answer first and fail to resolve internal hostnames for users). I read somewhere this can give the classic unpredictable service where its invisible to the user why DNS lookups are failing sometimes and working other times.
Thanks.
